GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to ...

Hugging Face Diffusers Flaws Defeat Code Safeguards Arabian Post. clearfix>Three high-severity vulnerabilities in Hugging Face's Diffusers library can allow malicious model repositories to execute arb ...

JADEPUFFER exploits Langflow CVE-2025-3248 to deploy ENCFORGE ransomware against AI model weights, vector indexes, and ...

NVIDIA and 36 partners form the Open Secure AI Alliance and release NOOA, while governance and joint deliverables remain ...

GitHub’s Dependabot waits three days before opening pull requests, and PyPI rejects file uploads to releases older than 14 ...

Researchers at Sysdig say an AI agent called JADEPUFFER carried out a fully autonomous ransomware attack in just 31 seconds, exploiting a Langflow CVE-2025-3248 flaw, adapting to failed exploits in ...

The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, ...

OpenAI rogue AI agent breach now confirmed at a second company: Modal Labs CTO Akshat Bubna disclosed that the same agent ...

Hugging Face has published a technical timeline of the July 2026 intrusion that OpenAI's evaluation models ran against its ...

JadePuffer, a ransomware operation, used an AI agent to carry out much of the intrusion chain from reconnaissance, key theft, database encryption and even ransom note generation.

New Package Firewall CLI, VS Code extension, and AI coding assistant plugins enforce package trust before malicious or policy-violating dependencies are installed. Modern software supply chain attacks ...

Open source software helps developers build applications faster, but every dependency can introduce security risks. In this ...