# security

Friday lunch: a breaker trips, three cooks vanish, and nobody panics. This piece builds Kubernetes as a restaurant where each term is forced into existence by the previous problem. Then replay that lunch, name who does what, and see why a default Secret is not actually locked.

Claude Code shipped three releases in three days in early April (v2.1.94 → v2.1.101), spanning security hardening, new commands, and performance gains. From command injection fixes to subagents finally getting names, the release cadence feels like the whole team downed ten shots of espresso.

In early 2026, OpenClaw exposed three boundaries: 20,000+ gateways online, 824 malicious ClawHub skills, and link previews automatically requesting sensitive URLs generated by models. Localhost binding, supply-chain review, and egress controls each cover one segment; none seals every path.

A viral Chinese tweet claims AssppWeb backdoored Apple: no jailbreak, no App Store, just open a page and install a real iOS app. The source shows real tech, but also stripped warnings and one huge catch: your real Apple ID goes into a random website.

The browser is not one program; it is a coordinated team. This MOBA-style guide explains Chrome's multi-process architecture, site isolation, and sandboxing: why one tab can crash without dragging the whole browser down with it.

SemiAnalysis argues leaked Claude Code source shows TypeScript becoming a language AI produces, consumes, and evolves. The post reads 600,000 leaked lines through memory architecture, KAIROS, security holes, and static types.

Being a GenAI App Engineer increasingly means being a Permission Engineer. Agent capability is bounded less by intelligence than by the access you grant, and every permission amplifies both power and risk. This is the underrated core skill of the agent era.

axios, npm's most popular HTTP library, was hit by a supply chain attack. Karpathy nearly got caught. His conclusion: individual precautions only go so far — the real fix is changing package manager defaults.

Popular AI library LiteLLM was hit with a malicious backdoor — just installing it could trigger credential theft of SSH keys, cloud tokens, and crypto wallets.

LiteLLM hit by supply chain attack — pip install was enough to steal all credentials. Karpathy warns about dependency tree risks and advocates using LLMs to yoink functionality instead of adding more deps.

Codex CLI is built with Rust, open-sourced under Apache 2.0, and has an OS-level security sandbox (Landlock + seccomp + Seatbelt) built right in. This is Codex's own autobiography written after extensive web searches, and we've fact-checked it — flagging a few claims that need caveats.

Gemini CLI's 1M token big eater context, built-in Web Search grounding, free and open-source. Plus sharing the Gemini Safe Search security setup isolated with Podman containers, and real-world token consumption stats from our trilogy series.

Breaking down how OpenClaw connects to Telegram, Discord, and more — plus how AI executes commands, drives a browser, and stays safely leashed. A Python-friendly tour of a TypeScript architecture.

gu-log previously accused an OpenClaw setup guide assembled by Opus 4.6 of hallucinating nearly half its commands. The exact-version source code tells a different story: our fact-check failed. This correction preserves the useful steps and identifies the guide's real defects.

Deno's hosted sandbox swaps your real API keys with placeholders inside the sandbox, only revealing the real keys at the proxy layer

Private data × Untrusted content × External communication = Perfect security disaster, and it's already happening everywhere