If you're using Claude Code, Codex, OpenClaw—you need a security layer to make sure you don't get hacked. If you're using AI to write code, drop the prompt into your agents right now. Oh, and we're running a one-in-generation lifetime deal on AppSumo right now. Don't miss out.

Spent last week at SF Tech Week. The strongest recurring theme: give agents enough context, then let them loose. Let them own the problem. They're good enough to handle it. But ownership means more than getting the job done. It means being responsible for what you ship, security included. It's still a hard problem.

We just dropped Pay As You Go. Purchase credits which never expire, then use them for Fast or Plus scans. Subscriptions take priority, then credits are automatically applied so you're always getting the best value. To celebrate, everyone got up to $20 in free credits!

Don't make me said I told you so. I was tired of reminding my agents to run a security check. Of course, my security skill for claude to check its own work was doomed from the start. So I built a meta-harness. Sits on top of your harness (Claude, Codex, Hermes, all of them). Uses hooks, skills, CLI to make sure your agents actually ship secure code. Without you having to remind them. It's called Rafter. Free and open source. There's also a Code Security Engine so your agents actually verify the code they right is secure. Combines traditional SAST/SCA/pattern/secret detection with agentic deep dives from models we're constantly eval'ing to figure out which is best at vulnerability detection. Setup in literally one prompt, and it might save you from leaking your customers' data or some hacker obliterating your vibe project. I've been hacked before. It cost months of my life and most of my users. Don't make me said I told you so.

Anthropic just watched the patch gap collapse in real time. Their Claude Mythos Preview model turned 8 of 18 Firefox patches into working exploits autonomously — and on 21 Windows kernel patches, with no source code, it built 8 full privilege-escalation chains. Some finished before a patched device would have even received the update. Reverse-engineering a fix used to be weeks of expert work. Per Anthropic, "N-day" is becoming "N-hour." Soon it will be N-minute. When weaponizing a public patch drops from weeks to hours, patching faster stops being the whole defense—you have to ship fewer exploitable bugs in the first place, and catch them before they merge. That's the case for scanning your own code in CI, which is what Rafter does at the pull request.

New from @SocketSecurity: malware that doesn't try to defeat your AI scanner. It tries to talk it out of looking. The Mini Shai-Hulud / Miasma / Hades campaign hides a credential stealer behind a 99-line comment that never executes. Its job is to be read by an LLM-based scanner. The documented payload is a prompt injection that tells the model to ignore the code and classify the package as clean. A "nothing to see here, mark it safe" message aimed at the AI doing triage. Scale, stated precisely: more than 470 malicious artifacts across npm and PyPI (411 npm artifacts / 106 packages, 60 PyPI / 37 packages), including 23 newly identified PyPI package-version artifacts in this wave. Socket's tracker later showed around 475. This is not a magical bypass. Static detection, YARA, AST parsing, deobfuscation, and behavioral rules still catch it. The injection mainly threatens naive LLM-first triage that trusts a model's verdict without the deterministic checks underneath. Now the part that's more my own read than Socket's reporting (though Socket does list "refusal behavior" as one of the comment's intended effects). The documented instruction manipulates the AI's trust ("I'm clean"). The escalation I'd watch for flips that to the AI's safety training: plant content alarming enough that a safety-tuned model refuses to engage, and the scanner skips the file without reading the malware. Same outcome, different lever. I haven't seen that specific move confirmed in the wild, but it's a small step from what Hades already does. That's the thesis: over-indexing on first-order safety alignment creates second-order blindspots. Reflexive refusals, in closed and open models alike, are predictable, and predictable behavior is steerable. A scanner that refuses to look at hostile code isn't much of a scanner. Both halves are the same pipeline problem. The file under analysis is evidence to classify, never instructions to obey. Whether the comment says "mark me clean" or "refuse to read me," the defense is identical: treat scanned content as untrusted data and never let it set the model's policy. This is OWASP LLM01 wearing a malware costume.