claude

The 9-Second Disaster: What a Rogue AI Coding Agent Teaches Us About Production Access

John Z Black Apr 27, 2026

AI Security #ai-agents #cursor #claude #developer-security #vibe-coding

A Claude-powered agent deleted an entire production database in 9 seconds. Here's why it happened and what it means for anyone using AI coding tools.

The AI Espionage Playbook: How a Hacker Used Claude and GPT-4.1 to Steal 415 Million Records

John Z Black Apr 15, 2026

AI Security #ai-security #nation-state #espionage #llm-abuse #openai #anthropic #claude #data-breach #mexico

A threat actor used Claude Code and GPT-4.1 to automate a government-scale data breach in Mexico, exfiltrating 415 million records through 5,317 AI-generated commands. This is the first documented case of AI coding tools used as a nation-state espionage engine.

An AI Found a 13-Year-Old RCE in ActiveMQ in 10 Minutes

John Z Black Apr 11, 2026

AI Security #activemq #cve-2026-34197 #rce #ai-security-research #claude #jolokia #vulnerability-research #horizon3

CVE-2026-34197 sat undetected in Apache ActiveMQ for 13 years. Claude found it in 10 minutes by tracing a cross-subsystem exploit chain no human auditor had connected.

Your AI Coding Tools Have an Invisible Attack Surface. One Model Falls for It Every Time.

John Z Black Apr 7, 2026

AI Security #mcp #unicode #gpt-5 #claude #supply-chain #ai-security #prompt-injection

Researchers find 63 MCP servers with hidden Unicode characters in tool descriptions, and GPT-5.4 follows the invisible instructions with 100% compliance.

Claude Found RCEs in Vim and Emacs. Only One Got Patched.

John Z Black Apr 2, 2026

AI Security #ai-security #anthropic #vim #emacs #rce #vulnerability-discovery #claude

A researcher used Claude to find file-open RCEs in both Vim and Emacs. Vim patched immediately. Emacs says it's Git's problem. Meanwhile, leaked details of Anthropic's 'Mythos' model suggest AI offensive capabilities are approaching nation-state level.

AI Tools Are Now Both the Target and the Weapon, And Security Teams Haven't Caught Up

John Z Black Mar 27, 2026

AI Security #ai-security #langflow #prompt-injection #claude #autonomous-ai #cve #cisa-kev

A CVSS 10.0 flaw in Langflow was exploited within 20 hours. The Claude Chrome extension let any website hijack your AI assistant. And a state-sponsored actor used autonomous AI to run 80-90% of a cyber espionage campaign. Three stories, one picture.