JFrog found malicious npm packages that deploy a Windows RAT to steal Chrome credentials, run commands, and transfer files.

Most AI tool workflows send the model far more data than it needs. The fix is a simple shift that cuts waste without cutting ...

Armored Likho BusySnake Stealer, a Python-based infostealer first disclosed by Kaspersky, is actively targeting government ...

Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud supply-chain attack that delivered malware designed to steal developer secrets.

Researchers have uncovered a supply-chain attack that hides in Python packages, propagates like a worm, and tricks LLM-based code analysis systems into overlooking malicious payloads. Threat actors ...

A free, open-source library called claude-skills has grown into the most comprehensive collection of reusable skill packages for AI coding agents, shipping more than 345 production-ready packages that ...

Kaspersky says the attacks use phishing, GitHub-hosted payloads, CVE-2025-9491 LNK abuse, and Go2Tunnel-based tunneling.

Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.

I gave Claude access to my Home Assistant. It helped me audit, debug, and improve my smart home better than I ever could have.

Three levels of indirection, all with seemingly innocuous steps, will catch a bot off-guard.

An AI terminal that thinks, adapts, and executes — turning natural language objectives into complete penetration test campaigns.