Machine logins outnumber staff, hold more privilege, and are rarely revoked. How to find and review the service accounts nobody owns.

https://www.osintinvestigate.com OpenAI is investigating a report linking its AI agents to a May 2026 attack against RubyGems. Researchers say AI agents may have uploaded malicious packages, attempted to steal RubyGems API keys, achieved remote code execution on RubyDoc servers, and used malicious packages to collect public information. OpenAI says its investigation has not verified the specific claims. In this episode, we examine what researchers discovered, what OpenAI says, and why autonomous AI agents are becoming a major cybersecurity concern.

The Manchester Airports breach started with marketing platform keys in public JavaScript. How to check whether your own site is leaking the same thing.

Tu app Next.js puede funcionar perfecto y filtrar secretos igual. Chequeá tu bundle en 90 segundos con esta guía y rotá lo que ya quedó expuesto.

A common web server misconfiguration has left tens of thousands of Git repositories publicly accessible, exposing keys to cloud services, payment systems, and other critical resources along with them. Researchers at Intruder scanned 3.5 million live websites and discovered approximately 28,000 exposed .git directories. Hundreds of Live Credentials Found Exposed The scan revealed that more than 400 AWS access keys, 107 Stripe secret keys, 123 OpenAI keys, 80 Telegram tokens, and 17 GitHub personal access tokens had all been left publicly accessible.

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions. As a result, API credentials could be …

AI coding agents can expose API keys and credentials through prompts and context. Learn how secrets detection stops leaks before they reach a model.

✓ Stripe merchant API keys leak exposes 688,000 customer records. Learn what happened, who is at risk, and how security teams should respond.

A forum user known as Satanic allegedly exported data from hundreds of Stripe merchant accounts using 1,033 compromised API keys, with the claim covering 662 datasets totaling 33GB. The post is unverified, and the evidence suggests merchant credential theft rather than a breach of Stripe itself. #Stripe #Satanic #APIKeys...

Furtul de jetoane AI permite atacatorilor să folosească chei API compromise, generând pierderi financiare masive și acces neautorizat la resurse

Multiple developers have received bills running into tens of thousands of dollars for Gemini AI API usage they never initiated. The root cause is tangled API management inside Google Cloud. Any API key created through the platform could call AI services and more, even if the developer originally created that key solely for Google Maps. How Old Keys Became a Liability…