AI tools, cybersecurity and development news aggregated from top sources — saved permanently with unique URLs.
A download endpoint that isn't an open proxy: signed URLs on Cloudflare Pages Functions
When a web tool lets people "download" a file that lives on someone else's CDN, the lazy version is …
The Repo Is the Attack Surface: Handing a Checkout to an Agent Build Without Handing Over Your Keys
A colleague pings me on a Friday with a link. "Can you run this repo through the build agent? It's a…
#HowISwitch: from "an agent that fixes bugs" to a crew that has to ask permission
Team Vulcan (Aditya Arnav, Pallab Das, Yuvraj Singh, Sri Ram) · Flip the Switch, November 4–7, 2026 …
Your agent treats every gate as a step. That is the bug and the feature.
Did Claude break in, or just ask for the key? If you ship agents, the Georgia story is not really a…
What a confidential H100 and H200 cost per GPU-hour in November 2026, and what the attestation covers
I run VoltageGPU, where confidential GPUs are rented as Intel TDX virtual machines with the NVIDIA G…
From AI Risk to Accountable Agents
In AI Risk is evolving, every day., David Hunt and I examined how an AI agent can pursue a legitimat…
I stopped asking clients for their passwords. Here's what I built on Switch instead. published: true
Every freelancer and agency has done this. A client hires you to fix their website or run their soci…
Organisational Roles as Contracts for AI Agents
Abstract An organisational AI agent needs defined responsibilities, relevant knowledge and bounded…
Verified, then swapped: two supply-chain attacks on the code you didn't write
On 4 November 2026, two unrelated reports landed on the same day. In the morning, Debian, Ubuntu an…
Building an Evidence Trail for CVE-2026-76466 Remediation
Building an Evidence Trail for CVE-2026-76466 Remediation The CVE-2026-76466 advisory names a clea…
CVE-2026-101909: Exploitation Preconditions for the Axios Gadget
CVE-2026-101909: Exploitation Preconditions for the Axios Gadget Security teams need a clear answe…
npm's worms ride a few big accounts, not your dependencies
At 10:41 UTC on 4 August, one npm account published poisoned versions of 132 packages. It took two a…