Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-07-18 · source-backed
The Hacker News covers a trust-boundary failure where the threat model has to include sibling extensions, not just web pages. If you deploy a browser-resident agent, enumerate what other locally installed software can reach its message surface. Most people model the browser agent's attacker as "a malicious website." It's also every extension your users installed in 2019 and forgot about.
Each link below shares sources, entities, or timing with this story.
Palo Alto Unit 42 disclosed a CVSS 8.8 vulnerability in Chrome's built-in Gemini panel that demonstrates a fundamentally new attack surface. A malicious extension using only basic ad-blocker-level permissions (declarativeNetRequests API) could inject JavaScript into the privil...
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
A public DSN. That's all the attacker needs. Not your credentials, not a compromised dependency, not a phishing link. The same write-only Sentry key that's sitting in your frontend bundle right now, by design, so the browser can report errors. Tenet Security and the Cloud Secu...
An open-source AI attack platform called CyberStrikeAI, built in Go and integrating 100+ security tools with Claude and DeepSeek via a custom MCP server (ARXON), was used to systematically compromise 600+ Fortinet FortiGate appliances across 55 countries. Claude's coding agent...
Anthropic shipped a browser built into Cowork on desktop, so Claude can navigate, read pages, fill forms and gather information while you keep working in your own browser. It never sees your tabs, bookmarks or passwords; you selectively import logins from Chrome, Edge or Firef...
Anthropic updated it July 23 so spoken conversations run on Sonnet and Opus, starting on whatever model you last used in text, with a picker to switch tiers mid-conversation. Voice now reaches Gmail, Google Calendar, Slack, Canva and Notion. Free tier gets Haiku plus single-ap...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.