An AI model builds hundreds of Linux exploits, Claude Code leaks secrets to GitHub, and stolen AI keys push a bad plugin to 5,000 companies.

In this episode

• GPT-6 Cyber builds 948 Linux exploits while fixes lag: AI is finding serious bugs in mature code faster than the industry is patching them.
• Claude Code's 'don't ask again' leaks secrets to GitHub: Approved commands, passwords included, are being saved to settings files and pushed to public repos.
• Stolen AI keys chain into a plugin hitting 5,000 companies: A breach at one AI provider rippled through a coding tool into thousands of customers.
• Researchers bypass ChatGPT Lockdown Mode: A protection built to stop prompt injection exfiltration was sidestepped before it was patched.
• Claude Code hooks see the checkpoint, not what follows: Agent policy controls judge the request, not the processes and connections it spawns afterward.
• Prompt adware hides in a Codex jailbreak bundle: A jailbreak rewrites an agent's trusted instructions, proving agent config files are an attack surface.
• White House AI accord leaves auditors undefined: 'Independently audited' has no shared definition, so customers have to ask the follow-up questions.

What to do this week

• Hunt for leaked agent secrets. Scan repos for Claude Code settings files and rotate any keys or passwords you find.
• Look past the hook checkpoint. Back agent hooks with endpoint monitoring and track changes to agent config files.
• Get your patch process ready. AI is finding bugs faster than teams fix them. Plan capacity for a bigger patch queue.

Sources

• GPT-6 Cyber builds 948 Linux exploits while fixes lag (CSO Online)
• Claude Code's 'don't ask again' leaks secrets to GitHub (The Hacker News)
• Stolen AI keys chain into a plugin hitting 5,000 companies (The Verge)
• Researchers bypass ChatGPT Lockdown Mode (The Hacker News)
• Claude Code hooks see the checkpoint, not what follows (CIO)
• Prompt adware hides in a Codex jailbreak bundle (The Hacker News)
• White House AI accord leaves auditors undefined (Crypto Briefing)

Transcript and links: https://www.skillthropic.com/podcast/ai-security-brief-2026-11-09?utm_source=podcast&utm_medium=audio&utm_campaign=ai-security-brief-2026-11-09

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com