Daily digest
- Microsoft Shows Agents Can Be Backdoored by Editing Fewer Than 10 Neurons: Researchers demonstrated a method called Lazarus that implants a backdoor (a hidden behavior activated by a chosen trigger) by editing fewer than 10 rarely used neurons, without retraining. When the trigger appears, the model emits an attacker's command that an agent executes with its own permissions, so the damage scales with the agent's privileges, though the attacker must be able to modify the model's weights.
- Bay Raises $50 Million for an AI Agent Control Plane: The Tel Aviv startup, founded in February 2026 by three former IDF Unit 8200 officers, emerged from stealth with a $37 million Series A led by Battery Ventures and $13 million in seed funding. Its platform discovers, monitors and governs AI agents and MCP servers (Model Context Protocol, a standard for connecting agents to tools), and its Enforcer component can allow, refer, redirect or deny agent actions in real time.
- Cross-Tenant Data Leak in GLM-5.3 on Cloudflare Workers AI: A large request could return another tenant's inference content instead of an answer, a flaw traced to upstream SGLang (an LLM serving framework) and since fixed by Cloudflare. Separately, vLLM issued three October advisories covering RCE (remote code execution, where an attacker runs commands on a system they do not own), a route to pickle.loads() (unsafe deserialization of untrusted data), and a denial of service triggered by a single request.
- Claude Code's "Don't Ask Again" Option Persists Credentials in Public Repositories: GitGuardian found 31,088 distinct secrets in .claude/settings.local.json files across 23,276 public GitHub repositories, with 5,343 still valid when detected, because the tool saves the full command string, credentials included, when a developer selects the option. Docker images built with COPY .. carried the same files, exposing another 613 distinct secrets in public Docker Hub images.