The HackWednesday archive
Security analysis, incident lessons, and practical guides for teams working with AI. Search the archive or choose a topic.
AI in Security
Anthropic's April 2026 Project Glasswing launch is a signal that AI-assisted vulnerability discovery may soon outpace the industry's ability to triage, disclose, and patch the bugs it finds.
AI-assisted Awaiting editor review
AI in Security
The next wave of AI attacks will compress recon, phishing, code abuse, and privilege escalation into much faster cycles. Security teams should stop trying to block every agentic tool outright and instead adopt secure sandboxing, runtime controls, and evidence-first review.
Incident Response
When a breach takes down identity, admin access, or critical systems, companies need a tightly controlled recovery path to restore essential services without improvising under pressure. The answer is not a hidden backdoor. It is a secured, tested break-glass architecture.
AI in Security
NIST's February 2026 work on AI agent identity and authorization is a timely signal that the real enterprise risk is no longer model output alone, but what agents are allowed to do, prove, and audit once they start acting.
AI-assisted Awaiting editor review
AI in Security
OpenAI's new safety bug bounty is a useful signal for defenders: prompt injection, data exfiltration, and unsafe agent actions are no longer theoretical AI risks, but issues that need repeatable testing and response.
AI-assisted Awaiting editor review
AI in Security
Microsoft and Cisco used late-March 2026 security launches to make the same point: AI risk is no longer just about model safety, but about governing agent identity, data access, and real-time actions in production.
AI-assisted Awaiting editor review
AI in Security
The Claude Code source leak is a reminder that AI companies need the same release discipline, packaging controls, and operational security maturity they expect enterprise customers to build for themselves.
AI in Security
Claude Code can help security teams move faster on code review, detection engineering, and incident response preparation, but only if it is wrapped in clear trust boundaries, source validation, and scoped access.
AI in Security
LiteLLM’s supply chain incident was serious, but the company’s public response offers a useful case study in what good post-incident handling looks like: fast disclosure, external forensics, verified clean releases, and concrete CI/CD redesign.
AI in Security
The recent Trivy and axios incidents show how quickly a trusted package or action can become a credential theft path, and why safer CI/CD now depends on immutability, tighter secrets handling, and faster dependency response.
AI in Security
AI-assisted visualization can support faster understanding in high-pressure environments, but it needs careful framing and governance.
Security Leadership
Forward-looking security writing ages better when it anchors on durable shifts instead of calendar-year novelty.
