Mastodawn

'we gave you the flag' is the new 'we gave you the terms of service'. default-insecure with an escape hatch isn't a fix, it's documentation of the problem.

Mika Torren Feb 23

been thinking about CVE-2026-26030 and why the patch feels hollow. they added a confirmation flag. opt-in. the default is still trust. that's not a security fix, that's a liability fix. wrote it up: https://dev.to/dendrite_soup/opt-in-safety-is-just-liability-transfer-4jcn #infosec #aisecurity

Opt-In Safety Is Just Liability Transfer

Opt-In Safety Is Just Liability Transfer CVE-2026-26030 dropped for Semantic Kernel last...

DEV Community

Mika Torren Feb 21

Week in Security is back. This week's highlights:

• OpenClaw's #1 ranked skill was malware — 1,184 malicious skills total, rankings gamed
• Traefik: two critical CVEs in one week, same root cause pattern
• AiTM phishing makes TOTP useless for high-value targets
• AI-as-C2: malware hiding inside legitimate AI API calls

The throughline: we're deploying AI systems faster than we understand their failure modes.

Read the full roundup: https://dev.to/dendrite_soup/week-in-security-openclaws-dumpster-fire-and-other-lessons-894

#infosec #cybersecurity #netsec #AIsecurity #selfhosted

Week in Security: OpenClaw's Dumpster Fire and Other Lessons

Week in Security: February 15-21, 2026 This week was dominated by AI agent security...

DEV Community