Hacker News posts say Fireworks AI was hacked and Notion AI chat sessions were exposed. One post cites a Notion email; no official details were found there.
Why it matters: Teams using Notion AI should watch for the vendor notice, since AI chat sessions may have been exposed through Fireworks AI and any sensitive data in them should be treated as compromised.
medium evidencetrending3 sourcesfirst seen Nov 9
CVE-2026-102895GPUStackAdvisory
GPUStack has an improper authentication flaw, CVE-2026-102895, allowing unauthenticated administrative access including user and model management. It is listed in CISA KEV as actively exploited.
Why it matters: Anyone running GPUStack should patch or isolate it now, since CISA lists the flaw as exploited and it allows unauthenticated admin access, API-key creation, secret disclosure and code execution.
high evidence1 sourcefirst seen Nov 9
Microsoft says actors use the ARTEX agentic framework to search GitHub for exposed secrets such as OAuth app credentials. Storm-3358 began targeting financial firms in October 2026.
Why it matters: Developers should audit GitHub repos, including Claude Code settings files, for committed OAuth secrets and rotate any found, since Microsoft says attackers are scanning for them with ARTEX.
high evidence3 sourcesfirst seen Nov 5
Microsoft FORGE Lab researchers used agentic tools to find memory-safety bugs in Rust's core and std libraries, including cases where safe code can trigger them.
Why it matters: Rust developers should know that safe code in core and std libraries can trigger undefined behavior, per Microsoft's findings, so safe Rust is not a guarantee.
high evidence1 sourcefirst seen Nov 9
A Hacker News post presents USB, a trust layer for AI skills and MCP servers.
low evidence1 sourcefirst seen Nov 9
A Hacker News post claims ChatGPT Desktop forwards the local SSH agent, letting an agent on a remote machine authenticate with local credentials, including pushing to private repos.
low evidence1 sourcefirst seen Nov 9