„By Wednesday morning, Anthropic representatives had used a copyright takedown request to force the removal of more than 8,000 copies and adaptations of the raw Claude Code instructions—known as source code—that developers had shared on programming platform GitHub.“
Because if there’s one thing GenAI companies absolutely don’t take lightly, it’s copyright.
https://www.wsj.com/tech/ai/anthropic-races-to-contain-leak-of-code-behind-claude-ai-agent-4bc5acc7
Claude Code's source code has been leaked via a map file in their NPM registry https://xcancel.com/Fried_rice/status/2038894956459290963 😂
Guess what? Most of code is either slop or even old good regex like for detecting negative sentiment in users prompt which is then logged
These tools are going to replace 80% of all dev jobs and their plugin is gonna maintain all security and banking code? 🤡
If someone comes to me today preaching about “post-quantum” security issues, I’ll remind them of the current state of security: the npm ecosystem gets abused daily, CI pipelines run left and right with full access to cloud services, so-called security devices like F5 and Ivanti are exposed (and compromised) to the internet, mailboxes get compromised just to change an IBAN in a PDF, and a simple phone call is still enough to get someone to hand over an MFA code.
But yes, by all means, let’s focus on post-quantum threats while handing AI tools SSH access like it’s a feature, not a confession.
Software and digital security should rely on verification, rather than trust. I want to strongly encourage more users and consumers of software to verify curl. And ideally require that you could do at least this level of verification of other software components in your dependency chains. Attacks are omnipresent With every source code commit and … Continue reading Don’t trust, verify →
VulnMCP is an MCP server built with FastMCP that provides AI clients, chat agents, and other automated systems with tools for vulnerability management. It offers modular "skills" that can be easily extended or integrated, enabling intelligent analysis and automated insights on software vulnerabilities.
A new component in the galaxy of tooling of vulnerability-lookup.
Thanks to @cedric who is becoming an orchestrator for many AI tools nowadays.
#cve #gcve #vulnerability #vulnerabilitymanagement #opensource #ai #mcp #vulnerabilitylookup
A modular MCP providing AI-driven vulnerability management skills, including severity classification and automated insights. - vulnerability-lookup/VulnMCP
Jens Ohlig
nixCraft 🐧
LWN.net
Alexandre Dulaunoy
Agnès H.
daniel:// stenberg://
Eris2cats
Cedric
CVE Program