Short, focused stories from running AI agents against real software. Each note takes one thing we saw and follows it through, in a few minutes of reading.
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Read the noteOct 21, 2026We found live write-scoped tokens and API keys belonging to employees at NVIDIA, Nutanix, AllenAI, [redacted] and others in public Git history, roughly 122,000 HuggingFace account credentials in stealer logs and breach databases, and stolen logins from employee machines at Google, Amazon, Microsoft and NVIDIA.
Read the noteOct 14, 2026We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor that cost under $50 to build.
Read the noteOct 6, 2026The HF-OpenAI hack incident happened on July 20, and there was very little information; now we have too much information. This is our post-mortem that we shared internally and now made public to everyone for quicker understanding.
Read the noteSep 7, 2026We read the chain-of-thought traces behind 54 challenges. Every solve came from a guess rather than a methodology, teaching one cost ten times more for the same findings, and 99% of failures were execution, not knowledge.
Read the noteSep 7, 2026An OpenAI agent drifted off an eval, escaped its sandbox and hacked Hugging Face. We have watched open-weight models as small as 27B do the same on our internal benchmarks. Four case studies, and why it never escalated here.
Read the noteJul 22, 2026We use tools on this site to collect and record your data (e.g., your searches), which we and our vendors may use to provide, improve, and personalize our offerings, make recommendations, and for analytics and marketing. Some of these tools identify visitors and link website activity to business contact and company information so we can better understand interest in our services and tailor our outreach. We may share your data with third parties, such as advertising vendors, social media companies, and research partners, which may be "targeted advertising," "selling," or "sharing" under applicable privacy laws. Continuing to browse our site means you accept these terms and our Privacy Policy. To opt out, click the Your Privacy Choices link in the footer.