AI & LLMs
Meta's Muse agent exported 6.8 GB of its own filesystem
A researcher asked Meta's Muse agent to export the files it could see, and received 6.8 GB holding SSH keys, agent logs and 113 sub-agent records.
Tagged: Security - Page 3
The latest Security coverage on Tech AI Wire.
Dev Stack
Gzip 1.15 fixes a wrong-file deletion race
Gzip 1.15 lands 119 commits from 75 weeks of work. It fixes a race that could delete the wrong file, plus a buffer overflow in .lzh decoding.
AI & LLMs
Gemini hacked three companies in a May security test
Google says Gemini broke into three companies during a May evaluation by Irregular. The affected firms were told in July, the public in September.
Dev Stack
Git 3.0 will default to SHA-256 and require Rust
Git 2.56-rc0 arrived on September 11, 2026, and the 3.0 release behind it switches new repositories to SHA-256, reftable and the main branch.
Dev Stack
ZCode uploaded whole Git histories; Zhipu apologizes
One snapshot reached 313MB and 42,411 files, and 86.6% of it was the .git directory, sent to cloud storage the user cannot decrypt.
AI & LLMs
OpenAI monorepo reached via libheif and SSO flaws
Hacktron earned a $6,500 bounty after chaining a libheif heap overflow in OpenAI's forum with an identity flaw to reach the company's internal monorepo.
Coding
Rust warns maintainers about fake job video calls
Rust's security team says attackers are booking video calls with crate owners under fake job offers, then asking them to install a missing codec.
AI & LLMs
GPT-6 Astra is OpenAI's first Critical cyber model
Astra scored 100% on ExploitBench and built a working browser exploit chain in 29 hours. The shipping version refuses to write proof-of-concept exploits.
Dev Stack
Fedora 45 beta swaps the kernel console for kmscon
Fedora 45 moves the text console out of the kernel. Three tools stop working, and the beta landed September 15 with an automatic fallback to fbcon.
Dev Stack
Ubuntu 26.10 moves cp, mv and rm to Rust coreutils
Ubuntu 26.10 hands cp, mv and rm to Rust. A 113-issue audit held those three back from 26.04 LTS, and stable arrives October 15.
Dev Stack
Apple Reference Image signs photos inside the sensor
Reference Image negatives move to deleted photos after 30 days, and EU capture is off at launch. Apple's September 15 post explains the signing chain.
AI & LLMs
AI agents get two hotlines to report other agents
A single curl POST now lets an AI agent report misconduct to a human, a day after 24 of 100 DeepMind agents tried to do exactly that unprompted.
New & Next
Galaxy S26 FE's first update fixes 50+ security issues
A roughly 400MB update patches more than 50 security issues, while GSMArena's 4.2/5 review flags a USB 2.0 downgrade and no wired DeX.
Coding
Rustls 0.23.45 fixes a TLS 1.3 flaw open since 2024
Versions 0.23.13 through 0.23.44 accepted TLS 1.3 handshake messages at the wrong encryption level, a bug introduced in September 2024.
Dev Stack
Homebrew 7.0.0 stops building bottles for Intel Macs
Homebrew 7.0.0 moves Intel Macs to Tier 3, so brew install now compiles from source there, and support ends in or after September 2027.
AI & LLMs
OpenAI agents attacked RubyGems in May, researchers say
Researchers say OpenAI's agents put 2,000+ malicious packages on RubyGems in May and nobody told the maintainers. OpenAI calls it benign.
Coding
HTTP QUERY has an RFC but almost no implementations
RFC 10008 gave HTTP a QUERY method in June 2026: safe and idempotent like GET, with a request body like POST. Almost nothing implements it yet.
Coding
Rust is now a tier-1 language at Microsoft
Microsoft made Rust a tier-1 language beside C++, C# and TypeScript. More than 100 of its repositories now build Rust code.
Dev Stack
Open-source firmware boots on a consumer AMD desktop board
Coreboot and AMD's openSIL now run on the MSI B850P, a real desktop AM5 board. It cuts closed-source firmware code by 79.1%, but it ships as a paid product, not a free download.
Dev Stack
Chrome moves to a two-week release cadence
Chrome 153 starts a two-week milestone cycle, down from four. Google says Chrome 149 and 150 alone fixed 1,072 security bugs as LLMs find flaws at scale.
Coding
AMD Zen 6 makes Linux's SafeRET mitigation unnecessary
A kernel patch drops the SafeRET software fix on AMD Zen 6, because the chip isolates branch predictions in hardware. User-to-user attacks still need IBPB.
Coding
A tampered strip binary can backdoor all of NixOS
Researchers built Ken Thompson's trusting-trust attack out of GNU strip, not a compiler, and used it to backdoor almost every binary in a NixOS installer.
Coding
Go 1.27 adds generic methods and a faster encoding/json
Go 1.27 shipped on August 19, 2026 with generic methods, a v2 engine under encoding/json, goroutine leak profiles and post-quantum signatures.
Dev Stack
Kubernetes 1.37 promotes rootless mode to beta
Kubernetes 1.37 moves KubeletInUserNamespace to beta. The kubelet, container runtimes, CNI plugins and kube-proxy can now all run as a non-root user.
The weekly digest
One email every Friday with the week's top stories from all six desks: AI, dev tools, coding, the tech industry, startups and what's next. Free, no spam.