Unpatched Claude extension flaws could allow hijacking of Gmail and Google Docs workflows ...

A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions ...

New TELEPUZ malware spreads through ClickFix, then steals browser cookies, logs keystrokes, runs commands, and installs itself as a Windows service.

Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with ...

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...

Claude for Chrome v1.0.80 still accepts forged clicks from other extensions, triggering Gmail, Docs, and Calendar tasks ...

Discover the AI Agent Safety Directory that evaluates AI agents before deployment with trusted safety ratings, risk insights, and performance benchmarks.

Adblock for YouTube has over 11 million installations. However, it can inject script code into any page uncontrollably.

Popular Chrome ad blocker with 10M installs exposes a dormant script path, raising hard questions about extension trust, permissions, and browser safety risks.

The controversy over vibe coding reached a new high this week after a developer added hidden instructions to his open source Java testing app to sabotage projects performed by AI coding agents. The ...

An unpatched SQL injection vulnerability in the Ghost content management system has been weaponized in an active, large-scale cyberattack that has compromised more than 700 websites worldwide — ...

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. The campaign was ...