# security

Claude Code shipped three releases in three days in early April (v2.1.94 → v2.1.101), spanning security hardening, new commands, and performance gains. From command injection fixes to subagents finally getting names, the release cadence feels like the whole team downed ten shots of espresso.

In early 2026, OpenClaw exposed three boundaries: 20,000+ gateways online, 824 malicious ClawHub skills, and link previews automatically requesting sensitive URLs generated by models. Localhost binding, supply-chain review, and egress controls each cover one segment; none seals every path.

A viral Chinese tweet claims AssppWeb backdoored Apple: no jailbreak, no App Store, just open a page and install a real iOS app. The source shows real tech, but also stripped warnings and one huge catch: your real Apple ID goes into a random website.

The browser is not one program; it is a coordinated team. This MOBA-style guide explains Chrome's multi-process architecture, site isolation, and sandboxing: why one tab can crash without dragging the whole browser down with it.

Anthropic explains how claude.ai, Claude Code, and Claude Cowork contain agents: model defenses miss, permission prompts create fatigue, and the hard boundary is the VM, sandbox, filesystem policy, and egress control.

SemiAnalysis argues leaked Claude Code source shows TypeScript becoming a language AI produces, consumes, and evolves. The post reads 600,000 leaked lines through memory architecture, KAIROS, security holes, and static types.

Being a GenAI App Engineer increasingly means being a Permission Engineer. Agent capability is bounded less by intelligence than by the access you grant, and every permission amplifies both power and risk. This is the underrated core skill of the agent era.

Your AI Agent is very obedient — but it might be obeying the wrong person. Prompt Injection is social engineering for AI. Tool Use Exploitation is giving a Swiss Army knife to a 5-year-old. Context Poisoning is someone secretly changing books in a library. And then there's the zoo escape.

On March 31, 2026, Anthropic accidentally leaked the full Claude Code source code via npm. Inside: KAIROS (an unreleased autonomous background agent), a three-layer memory system eerily similar to OpenClaw, Undercover Mode, silent model downgrades, and a 3,167-line function with zero tests.

axios, npm's most popular HTTP library, was hit by a supply chain attack. Karpathy nearly got caught. His conclusion: individual precautions only go so far — the real fix is changing package manager defaults.

Popular AI library LiteLLM was hit with a malicious backdoor — just installing it could trigger credential theft of SSH keys, cloud tokens, and crypto wallets.

LiteLLM hit by supply chain attack — pip install was enough to steal all credentials. Karpathy warns about dependency tree risks and advocates using LLMs to yoink functionality instead of adding more deps.

Codex CLI is built with Rust, open-sourced under Apache 2.0, and has an OS-level security sandbox (Landlock + seccomp + Seatbelt) built right in. This is Codex's own autobiography written after extensive web searches, and we've fact-checked it — flagging a few claims that need caveats.

Gemini CLI's 1M token big eater context, built-in Web Search grounding, free and open-source. Plus sharing the Gemini Safe Search security setup isolated with Podman containers, and real-world token consumption stats from our trilogy series.

Karpathy's Claw-era security reality check frames Claws as the next layer above agents, but warns exposed instances, RCE, supply-chain poisoning, and malicious skills can turn productivity into liability. His direction: small core, containers, auditable skills.

Breaking down how OpenClaw connects to Telegram, Discord, and more — plus how AI executes commands, drives a browser, and stays safely leashed. A Python-friendly tour of a TypeScript architecture.

gu-log previously accused an OpenClaw setup guide assembled by Opus 4.6 of hallucinating nearly half its commands. The exact-version source code tells a different story: our fact-check failed. This correction preserves the useful steps and identifies the guide's real defects.

1Password's security team found that the most downloaded skill on ClawHub was actually a malware delivery vehicle. Worse: it wasn't an isolated case — hundreds of skills were part of the same campaign. When markdown becomes an installer, skill registries become supply chain attack surfaces.

Crypto guy Jordan Lyall spent a week researching security before installing OpenClaw — this is the security guide he wished existed, written for people who don't want to become the next victim

Part 2 of the series: From SOUL file design to real disaster stories — TARS going dark for 3 days while traveling, context overflow crashes, rate limit surprises. Plus emergency procedures: what to do if your agent gets compromised.