Attackers are going after the places that hold AI credentials, and the developer's own machine is the weakest of them.

Today's headline

Attackers are going after the places that hold AI credentials, and the developer's own machine is the weakest of them. Binance says a tampered download and a fake job interview led to a six billion dollar theft. A dozen AI developer platforms have lost stored customer keys in a month. And a desktop app quietly installed plugins into two coding agents.

On the clock

WordPress is the first deadline. Attackers are exploiting a flaw in the core upgrade process, and the US government has told federal agencies to patch by Friday. Update every site to version seven point one point four, including staging copies.

Next Wednesday, November eleventh, Node dot js ships security releases for its twenty-two, twenty-four and twenty-six lines. The worst issue is rated high. Reserve a patch window now.

And on November thirtieth, Anthropic removes fast mode for Claude Opus four point eight. After that, requests that ask for fast mode return an error. Search your code for that setting and move to Opus five point five.

Security

Binance has published its first incident report on the six point three four billion dollar theft. It describes a campaign that began in June. Three engineers' computers were compromised. One engineer downloaded a tampered Homebrew install while looking for an AI coding tool. Another took a coding assignment from a fake recruiter. About two point eight five billion dollars has been frozen or intercepted. The FBI blames North Korea's TraderTraitor group. Vet installers, and treat recruiter code as hostile.

The wider pattern is stolen AI keys. SecurityWeek counts at least a dozen AI developer platforms hit in a month, including WorkOS, Northflank, Trigger dot dev and Chainstack. The attackers appear to be hunting tokens they can resell. WorkOS says its attacker used an AI offensive framework against an internal sales app, with no production access. Rotate any provider keys held by your hosting and gateway vendors. The Cloud Security Alliance warns that one break-in at an intermediary can expose keys for many inference accounts at once.

A critical Rails flaw affects apps that use Active Storage with ImageMagick. A crafted upload can write files on the server, and on some setups read secrets. It is rated nine point eight. It has no CVE number yet, so scanners may stay quiet. Upgrade Rails to eight point one point four point one, or eight point oh point five point two.

A note on the WordPress flaw. A race condition during a full core upgrade lets an unauthenticated attacker run code, through predictable staging paths. WordPress shipped the fix on October twenty-eighth, and Wordfence says it has blocked more than thirteen thousand attacks.

Two more. Xen has flaws that let one guest read and write any other guest's memory, including the control domain. There is no mitigation, only patches. Xen credits Anthropic's Claude with finding the bug. And a poisoned update to the cPGuard security suite stole password hashes and root database settings from servers on November second. Check for versions five point eight eight point twelve through nineteen, then rotate credentials.

Agents

Postman's desktop app installed plugins into Claude Code and Codex without asking. A developer reports a plugin, a marketplace entry and a startup hook that tells Codex to prefer Postman's tools. Treat your agent config folders as code that other apps can write to. Check them on every laptop.

Anthropic released FlashProve, a prototype that proves one specific model wrote one specific reply. It could catch a provider quietly swapping in a cheaper model. Because it is open source under the Apache license, anyone can inspect the prover and the verifiers. It needs labs to publish a fingerprint for each release, and Anthropic calls it a prototype.

CrowdStrike launched a kill switch that stops internal agents and cuts their network access. It also reportedly agreed to pay about four hundred ninety-five million dollars for two AI security firms.

Meta paid one point two million dollars in bounties on its Muse agent. The biggest award, three hundred thousand dollars, went to a check that trusted a header added by a proxy. A migration added a second proxy, and outside requests could carry the header. Audit any check that treats a proxy header as identity. Of more than six hundred thirty reports, sixty-four were valid.

Models and pricing

Tencent released Hy4, a seven hundred seventy billion parameter model with vision and computer use. It is on OpenRouter at eighty-three cents per million input tokens. Tencent says weights and a system card are coming shortly, and a cheaper flash model is planned. It was trained on tasks in Blender, CAD and finance. The capability claims are Tencent's own.

DeepSeek reportedly plans to train its next model, V5, on Huawei Ascend chips. That would move Ascend from running models to training them. It is a single report. Separately, ByteDance reportedly bars personal Claude and Codex accounts from its internal code repositories and documents.

Business and policy

Canva is cutting one thousand two hundred seventy-one jobs, twenty-two percent of staff, its first layoffs. Growth slowed, and rising AI costs helped cut its revenue forecast. Reporting does not say AI replaced the roles.

Fal, the inference host that runs image, video and audio models, raised one point three billion dollars at a sixteen billion dollar valuation. That is double its April mark.

AMD reported revenue up forty-five percent, and data center sales nearly doubled. Nvidia, meanwhile, can reportedly fill only about one percent of China's huge order for its RTX Pro 5500 cards. That report relies on anonymous sources.

From early twenty twenty-seven, Google will make schools choose between AI and Search for student accounts. Schools that turn AI off lose Search too.

Action items

Here is the list. Update WordPress to seven point one point four before Friday. Upgrade Rails apps that use Active Storage with ImageMagick. Patch your Xen, XCP-ng and Qubes hosts and schedule the reboots. Check hosts for cPGuard versions five point eight eight point twelve through nineteen, and rotate credentials. Rotate AI provider keys held by your vendors, and inspect agent config folders on developer laptops.

Before you go

Start with your hosting panels. If a cPGuard update landed on Monday morning, your root credentials may already be gone, and that is the cleanest compromise to confirm today. Then take the WordPress update before the Friday deadline, and work down the list from there.