Top Story — Claude Code's Source Leaked: Anthropic accidentally published Claude Code v2.1.88 to npm with the complete unobfuscated TypeScript source — 512,000 lines across 2,000 files. Buried inside: KAIROS, an autonomous daemon that runs 24/7 in developer environments, monitoring files and executing tasks without explicit user requests.
North Korea Compromised the Axios npm Package: A persona called "nicolo-ribaudo" spent two weeks building trust with the maintainer through AI-generated, technically convincing pull requests — then published malicious versions targeting 100M+ weekly downloads.
Mercor Breached via LiteLLM Supply Chain: The $10B AI hiring startup lost 4TB of data — including AI training data and interview recordings — through last week's TeamPCP LiteLLM compromise.
Microsoft Open-Sources Agent Governance Toolkit: Runtime security covering all OWASP Agentic Top 10 risks — tool call validation, output guardrails, human-in-the-loop enforcement.
Databricks Launches Lakewatch Agentic SIEM: AI agents that autonomously triage, investigate, and contain threats. Early benchmarks: 94% reduction in mean-time-to-respond.
CrowdStrike Acquires Seraphic ($420M): Browser security acquisition signals the shift toward protecting where AI agents actually operate — inside the browser.
87% of AI-Generated PRs Contain Vulnerabilities: AI code assistants generate real-world bugs at scale — mostly from training data poisoning and insecure defaults.
Curator's Pick
#6: Instructions Are Not Guardrails. Anthropic leaked source code because Bun ships source maps by default and nobody caught it. North Korea convinced a maintainer to trust an AI-generated persona through two weeks of technically convincing messages. Inside Claude Code, KAIROS runs autonomously with no user confirmation. Three different failures this week, one shared root cause: treating instructions as security boundaries. Instructions are a communication tool, not a control. They fail silently — when they fail, nothing alerts you. The question isn't whether your instructions are good. It's whether anything enforces them.