Four supply-chain incidents hit OpenAI, Anthropic and Meta in 50 days: three adversary-driven attacks and one self-inflicted packaging failure. None targeted the model, and all four exposed the same gap: release pipelines, dependency hooks, CI runners, and packaging gates that no system card, AISI evaluation, or Gray Swan red-team exercise has ever scoped.

On May 11, 2026, a self-propagating worm called Mini Shai-Hulud published 84 malicious package versions across 42 @tanstack/* npm packages in six minutes flat. The worm rode in on release.yml, chaining a pull_request_target misconfiguration, GitHub Actions cache poisoning, and OIDC token extraction from runner memory to hijack TanStack’s own trusted release pipeline. The packages carried valid SLSA Build Level 3 provenance because they were published from the correct repository, by the correct workflow, using a legitimately minted OIDC token. No maintainer password was phished. No 2FA prompt was intercepted.

The trust model worked exactly as designed and still produced 84 malicious artifacts.

Two days later, OpenAI confirmed that two employee devices were compromised and credential material was exfiltrated from internal code repositories. OpenAI is now revoking its macOS security certificates and forcing all desktop users to update by June 12, 2026. OpenAI noted that it had already been hardening its CI/CD pipeline after an earlier supply-chain incident, but the two affected devices had not yet received the updated configurations. That is the response profile of a build-pipeline breach, not a model-safety incident.

Four incidents, one finding

Model red teams do not cover release pipelines. The four incidents below are evidence for a single architectural finding that belongs in every AI vendor questionnaire.

OpenAI Codex command injection (disclosed March 30, 2026). BeyondTrust Phantom Labs researcher Tyler Jespersen found that OpenAI Codex passed GitHub branch names directly into shell commands with zero sanitization. An attacker could inject a semicolon and a backtick subshell into a branch name, and the Codex container would execute it, returning the victim’s GitHub OAuth token in cleartext. The flaw affected the ChatGPT website, Codex CLI, Codex SDK, and the IDE Extension. OpenAI classified it Critical Priority 1 and completed remediation by February 2026. The Phantom Labs team used Unicode characters to make a malicious branch name visually identical to “main” in the Codex UI. One branch name. That is where the attack started.

LiteLLM supply-chain poisoning and Mercor breach (March 24–27, 2026). The threat group TeamPCP used credentials stolen in a prior compromise of Aqua Security’s Trivy vulnerability scanner to publish two poisoned versions of the LiteLLM Python package to PyPI. LiteLLM is a widely adopted open-source LLM proxy gateway used across major AI infrastructure teams. The malicious versions were live for roughly 40 minutes and received nearly 47,000 downloads before PyPI quarantined them.

That was enough.

The attack cascaded downstream into Mercor, the $10 billion AI data startup that supplies training data to Meta, OpenAI, and Anthropic. Four terabytes exfiltrated, including proprietary training methodology references from Meta. Meta froze the partnership indefinitely. A class action followed within five days. One compromised open-source dependency sitting 40 minutes on PyPI created a cross-industry blast radius that no single vendor’s model red team would have caught.

Anthropic Claude Code source map leak (March 31, 2026). This incident was not adversary-driven. Anthropic shipped Claude Code version 2.1.88 to the npm registry with a 59.8 MB source map file that should never have been included. The map file pointed to a zip archive on Anthropic’s own Cloudflare R2 bucket containing 513,000 lines of unobfuscated TypeScript across 1,906 files. Agent orchestration logic. 44 feature flags. System prompts. Multi-agent coordination architecture. All public. All downloadable. No authentication required. Security researcher Chaofan Shou flagged the exposure within hours, and Anthropic pulled the package. Anthropic confirmed it was a “release packaging issue caused by human error.” This was the second such leak in 13 months. The root cause was a missing line in .npmignore. No attacker was involved, but the release-surface gap is identical. No human review gate existed between the build artifact and the registry publish step.

TanStack worm and downstream propagation (May 11–14, 2026). Wiz Research attributed the Mini Shai-Hulud attack to TeamPCP with high confidence. StepSecurity detected the compromise within 20 minutes. The worm spread beyond TanStack to Mistral AI, UiPath, and 160-plus packages within hours. Mini Shai-Hulud even impersonated the Anthropic Claude GitHub App identity by authoring commits under the fabricated identity “claude ” to bypass code review.

Four incidents. Three frontier labs. One finding. The red-team scope stops at the model boundary, and the build pipeline sits on the other side of it.

The timing no system card can explain

On May 10, 2026, OpenAI launched Daybreak, a cybersecurity initiative built on GPT-5.5 and a new permissive model called GPT-5.5-Cyber designed for authorized red teaming, penetration testing, and vulnerability discovery. Daybreak pairs Codex Security with partners, including Cisco, CrowdStrike, Akamai, Cloudflare, and Zscaler. OpenAI positioned the launch as proof that frontier AI can tilt the balance toward defenders.

The next day, the TanStack worm compromised two OpenAI employee devices.

OpenAI’s own incident disclosure acknowledged the gap directly. The company had already been hardening its CI/CD pipeline after the earlier Axios supply-chain attack, but the two affected devices “did not have the updated configurations that would have prevented the download.” The controls existed. The deployment was in progress. The worm arrived first.

The security community saw the same gap: Security researcher @EnTr0pY_88 noted on X that the real signal was the certificate rotation, not the exfiltrated code. “The cert rotation…is what you do when the blast radius reached signing trust, not just source access.” @OpenMatter_ put the SLSA provenance failure in one sentence. “If an attacker controls your CI runner, they control your attestations. Policy-based security is failing at scale.” And @The_Calda compressed the disclosure’s internal contradiction into seven words. “‘Limited impact’ but the next sentence is ‘we’re rotating signing certs.’”

A company that launched a cyber defense platform on Sunday and disclosed a build-pipeline breach on Tuesday is not failing at model safety. OpenAI is demonstrating the exact gap this audit grid exists to close. The model red team and the release-pipeline red team are two different disciplines; four incidents in 50 days suggest only one of them is being funded consistently.

The VentureBeat Prescriptive Matrix

The matrix below maps the seven release-surface classes missing from AI vendor questionnaires, with vendor hit, failure mechanism, detection gap, technical mitigation, and priority tier a security team can execute before Q2 renewals close.

For teams that need to map these rows into existing GRC tooling, rows 2, 3, and 5 align with NIST SSDF PS.1.1 (protect all forms of code from unauthorized access and tampering). Row 4 maps to SSDF PS.2.1 (provide mechanisms for verifying software release integrity). Row 6 maps partially to SLSA Source Track requirements for verified contributor identity, though no published framework directly addresses upstream dependency maintainer credential provenance. Row 7 is not yet addressed by any published framework, which is itself the finding.

Security director action plan

The matrix tells your team what to fix. Three actions tell security directors how to move it forward.

1. Add one question to every AI vendor questionnaire. “Does your organization red-team its release pipeline, including CI runner trust boundaries, OIDC token scoping, dependency lifecycle hooks, and registry publish gates? Provide the last assessment date and scope.” No date and no scope document is the finding.

2. Run rows 2 through 7 against your own CI pipelines this week. StepSecurity and Snyk both published detection and remediation steps for the TanStack worm patterns. Dev teams pull OpenAI SDKs, Anthropic packages, and Llama weights through npm, PyPI, and HuggingFace every week. The same patterns that got exploited are in your CI right now.

3. Brief the board on the provenance gap. The TanStack worm proved that valid cryptographic provenance can sit on top of a malicious package. Attestation tells the board where a package was built. Behavioral analysis tells the board what it does after install. Q2 renewal requires both. Snyk’s analysis recommends pinning trusted publisher configurations to specific branches and workflows, not just repositories. That is the language the board presentation needs.

The worm already knows where your AI credentials live

Mini Shai-Hulud does not stop at CI secrets. Datadog Security Labs documented that the payload reads ~/.claude.json and exfiltrates it. It scans for 1Password and Bitwarden vaults, Kubernetes service accounts, cloud provider tokens, and shell history files where developers paste API keys. StepSecurity’s deobfuscation confirmed that Mini Shai-Hulud harvests Claude and Kiro MCP server configurations, which store API keys and auth tokens for external services. For developers using AI coding agents, the worm already knows where their credentials live.

OpenAI, Anthropic, and Meta will keep publishing system cards. They will keep funding red-team competitions. They will keep passing model evaluations. None of that stops the next worm from riding in on release.yml.

The TanStack postmortem team said it directly. Modern supply-chain defenses are important but not sufficient on their own. Teams must proactively identify and close workflow gaps rather than relying solely on the security features of their tools.

from the MAGA’s-replacement-theory dept

Behold this utter bullshit, uttered by the Trump administration’s “border czar” Tom Homan:

White House border czar Tom Homan said Thursday he’s “sure” Immigration and Customs Enforcement (ICE) officers have detained U.S. citizens, “but we don’t deport them.”

Homan told reporters outside the White House that U.S. citizens have “nothing to fear.”

“We deport people that are going to be deportable,” he continued. “We arrest people that will be deportable based on suspicion. Have U.S. citizens ever been shortly detained based on suspicion? I’m sure. I’m sure.”

This is demonstrably false. For the moment, children born in the United States are considered to be US citizens. The Trump administration wants to end birthright citizenship, but it hasn’t managed to accomplish that yet. But that isn’t stopping it from deporting US citizens just because they’re too young to be capable of invoking their rights, like the two-year-old US born child the administration deported to Honduras in direct violation of a federal court order.

Pretending it’s no big deal for US citizens to have their rights violated intermittently as the government goes after non-white people, that’s even more obnoxious. That the administration hasn’t deported large numbers of US citizens is a miracle, rather than an indicator of ICE competence.

If you keep arresting the same person over and over, sooner or later what’s left of the safety net will fail and that citizen will be expelled from the country. That’s what one US citizen is hoping to prevent with his lawsuit against the government, which is being handled by the Institute for Justice. On multiple occasions, federal officers have decided this US citizen is deserving of deportation, as Isabela Dias reports for Mother Jones:

In a declaration submitted as part of a civil lawsuit, Garcia Venegas said the agents pulled him out of the car and onto the ground, and shackled his arms and legs. Garcia Venegas estimates seven or eight law enforcement personnel, including US Immigration and Customs Enforcement officers and local police—most of whom wore plain clothes and tactical vests—surrounded him. They asked him no questions.

Garcia Venegas, a 26-year-old Florida-born US citizen, said he tried to show his Alabama STAR ID as proof of status, but the agents ignored him. They put him in the back seat of one of their vehicles, questioned him about his place of birth, and searched his wallet. He offered to provide his American passport, which was inside the house, but the agents refused. Several minutes later, they released him, but not before having dogs sniff the truck for drugs, according to the declaration. Garcia Venegas said the officers told him he had been stopped because the car he was driving was registered in the name of his brother, who is undocumented.

One time might be an aberration. Repeated occurrences are something else entirely.

This wasn’t the first time ICE agents stopped and held Garcia Venegas. In fact, Saturday’s encounter marked the third such incident, according to court filings. Garcia Venegas, whose parents are originally from Mexico, had twice before been detained after ICE raided construction sites where he was working, and twice before he was let go after proving his American citizenship.

On one hand, repetition indicates that anti-migrant efforts under Trump are extremely sloppy, overseen by people who value quantity over quality. That’s almost certainly true, especially now that the DHS has lowered hiring and training standards for ICE. On top of that, there’s the casual racism of the policies, which — thanks to the Supreme Court — are pretty much legal because officers are allowed to infer from darker skin tones that someone might be in the country illegally.

On the other hand, there’s a chance Venegas is being targeted repeatedly for vindictive reasons. That seems less likely, at least in terms of what’s been detailed in his court filings. If it continues now that his lawsuit has been filed, that might suggest his arrests and detentions are no longer accidental.

Whatever the case, there’s going to be more of this happening, no matter what half-assed niceties Tom Homan might state during press conferences. The Trump administration is fighting to end birthright citizenship in this nation. If it does make this happen, it won’t be retroactive. But that’s hardly going to matter to the DHS and its underling agencies, which have repeatedly violated the letter and spirit of existing laws, when not violating direct orders from federal courts.

And this administration is going even further, seeking to “denaturalize” certain US citizens in order to deport them:

The Trump administration on Friday announced a major expansion of its denaturalization campaign targeting foreign-born American citizens accused of fraudulently obtaining U.S. citizenship.

The Justice Department unveiled denaturalization cases in federal courts across the country against roughly a dozen U.S. citizens born overseas. Officials said they had committed serious crimes or immigration fraud, or had ties to terrorism.

At first glance, this might look like the sort of thing the US government should be doing. This takes serious criminals off our books (so to speak) and sends problematic naturalized citizens back to their home countries to be their problem.

But we already know how this is going to work. The “worst of the worst” lie has been uttered repeatedly to defend the administration’s aggressive/transgressive tactics. But the facts have repeatedly shown the administration just wants non-whites gone. It doesn’t really care about any relevant criminal activity.

The same thing is happening here. The administration is making it clear this is just more bigotry, rather than an actual effort to root out the “worst of the worst” for the safety of the nation.

The group of naturalized U.S. citizens whose citizenship the Justice Department is now seeking to revoke includes immigrants from Bolivia, China, Colombia, Gambia, India, Iraq, Kenya, Morocco, Nigeria, Somalia and Uzbekistan.

While this group does include some accused of molesting a child and a supposed terrorist sympathizer, it also includes these people:

The group also includes individuals who allegedly used false identities to apply for immigration benefits and a man who allegedly entered into sham marriages to commit immigration fraud.

These are far less serious crimes, which don’t lend themselves to the “worst of the worst” narrative the administration deploys when its actions are questioned.

The lack of diversity (in other words, no white people or those with ties to Western European countries) in those selected to be first up for denaturalization is a leading indicator of further unlawful detentions of US citizens. As the government goes after more non-white US citizens under this pretense, DHS agencies will respond by rounding up more non-white US citizens, turning Homan’s false assurances into the lie it was always meant to be.

The administration actually wants to deport certain US citizens. That these agencies are far too willing to oblige, even without the necessary facts in hand, will definitely increase the number of citizens being held by ICE and correspondingly increase the number of those deported despite still being citizens of this nation.

Filed Under: bigotry, cbp, dhs, donald trump, florida, ice, leonardo garcia venegas, mass deportation, rights violations, texas, tom homan, trump administration

After three weeks of testimony and not much deliberation, a jury has ruled against Elon Musk, finding that Sam Altman and Greg Brockman were not liable in the case. The jury found that the statute of limitations had already passed when Musk sued the two executives. 

Musk filed his lawsuit in 2024, accusing them of “stealing a charity” following his departure from the AI lab in 2018. Though the jury in the case served only an “advisory” role, Judge Yvonne Gonzalez Rogers agreed with the jury’s ruling. Musk’s claims of “breach of charitable trust and unjust enrichment are dismissed as untimely,” she said according to CNBC. Though Musk could still appeal the ruling, Rogers told his lawyer she would dismiss an appeal “on the spot.”

At the center of the case was OpenAI’s reorganization that saw it convert from a nonprofit to a public benefit corporation. Musk has maintained that the move, along with Microsoft’s $13 billion investment in the firm, was a breach of OpenAI’s original contractual agreements. A major question of the trial, though, was when Musk became aware of OpenAI’s for-profit ambitions due to the three-year statute of limitations in the case.

“The facts and the timeline in this case have long been clear, and we welcome the jury’s decision to dismiss these claims as untimely,” a Microsoft spokesperson said in a statement. “We remain committed to our work with OpenAI to advance and scale AI for people and organizations around the world.”

In testimony, Musk’s lawyers tried to paint Altman as a dishonest, lying person, even going so far as to reference his recent unflattering New Yorker profile. Altman often struggled to answer the allegations against him. Asked if he thought himself to be an honest person, Altman said, “I believe so.” Musk’s legal team immediately jumped on that answer. “You believe so?” asked Steven Molo, the lead lawyer for the world’s richest man. “I will just amend my answer to yes,” Altman responded.

When he was later questioned about statements from past OpenAI employees, including former CTO Mira Murati, who described Altman as someone who would say “one thing to one person and completely the opposite to another person,” Altman repeatedly claimed he had not seen their testimony. “You’ve repeatedly been called deceptive and a liar by people with whom you’ve done business, right?,” Molo asked. “I have heard people say that,” Altman responded.

Where Altman came off as meek during his testimony, Musk was combative and testy. “Your questions are not simple. They are designed to trick me, essentially,” Musk told William Savitt, OpenAI’s lead counsel. As the trial inched forward to its conclusion, Musk was absent, despite an order from Judge Yvonne Gonzalez Rogers that he remain in case he was called to testify again. “Mr. Musk isn’t here today. My clients are,” Savitt told the jury during closing arguments. “Mr. Musk came to this court for exactly one witness: Elon Musk. Now he’s in parts unknown.” Parts unknown, in this case, turned out to be by Trump’s side for his diplomatic trip to China.

Even before the trial began, Musk faced longshot odds at securing the remedies he sought. The billionaire sought to undo OpenAI’s for-profit conversion and force the removal Altman and Brockman from their positions on top of the company. There might have been a point early in OpenAI’s negotiations with the Attorneys General of California and Delaware where Musk might have had a chance to get his way, but it was clear Judge Gonzales Rogers was deeply hesitant to undo the work of public officials. When Musk filed a request for a preliminary injunction to stop the conversion, the judge said the request was “extraordinary and rarely granted.”

The company is blaming this increase on “ongoing market conditions.”

There are plenty of porous materials out there that we’re all readily familiar with. Fabrics and wood are great examples, allowing liquids or gases to pass through to a certain degree—a property which is useful or problematic depending on the application.

Metals, however, are not something we would readily consider to be porous. They are solid, unyielding, and impermeable. However, with the right techniques, it is possible to produce so-called “breathable” steel, which has particularly interesting applications in the molding industry.

Breathe Into Me And Make Me Real

Imagine you’re making tooling for an injection molding operation. You’re using steel, of course, because you need a hard, resilient material that can deal with the high temperatures and pressures involved. It’s tough, and readily able to be machined into the desired geometry for your application. Of course, it doesn’t let liquid or gas pass, since it’s a solid impermeable material. This means that when you inject your mold full of hot plastic, you need to find somewhere for the air inside to go. Otherwise, the gas in the mold will end up dissolved in the molten plastic, causing voids, surface imperfections, and other irregularities. Chasing away gas porosity defects in finished parts is one of the major jobs of casting engineers the world over, an endless battle against the forces of heat transfer and fluid mechanics.

Traditionally, this is deal by designing a mold with exhaust ports or vacuum hookups to allow the air to vent out as needed. This takes a great deal of work to get right, particularly when it comes to getting your defect rates as low as possible in mass production. If your gas can’t vent fast enough, or if there are areas where it gets trapped, you end up with defects, and you have to go back to the drawing board.

Breathable mold steel attempts to solve this problem by venting gas through the tooling itself. It allows the creation of a steel mold that is full of tiny little pores that allow air to pass through, while still acting largely impermeable to the molten plastic being molded.

Breathable mold steel is quite something to behold, behaving quite unlike a normal steel part in this regard.

As you might imagine, it’s quite difficult to make a steel mold with complex geometry that also has lots of tiny contiguous holes that allow gases to pass through. It is possible, however, by using some tricky additive manufacturing techniques.

As outlined in one research paper, it’s possible to produce breathable steel via selective laser melting (SLM) 3D printing techniques. This involves using a high-powered laser to fuse metal powder together, layer by layer, to produce a final part. Combining a foaming agent with the metal powder enables the creation of 3D-printed metal parts with incredibly fine interconnected pores.

The pores need to be particularly small, on the order of 80 micrometers or less, such that they allow gas in the mold to pass freely while blocking the flow of the larger polymer molecules of the injected plastic.

Chromium nitride is one foaming agent typically used, for the fact that the Cr and N released during its decomposition both lend beneficial properties to the steel of the finished product. The foaming agent is mixed in with the steel powder, and melts along with it as the part is being produced. The breakdown of the foaming agent releases gas bubbles which creates pores in the steel part as it is produced in a relatively predictable manner.

The level of porosity can be controlled by the amount of foaming agent mixed in to the steel powder, as well as the laser settings. Lower melt pool temperatures caused by faster scanning speeds or lower laser powers tend to favor more porous structures, due to the fluid mechanics involved and how the cooler liquid steel flows into existing pores.

There have been earlier attempts to vent molds with special breathable steel inserts in the past. These consist of premade rectangular inserts or round bars which have been made with so-called “ventilated steel” like PM-35. This material is made by sintering steel powders together in such a way to create a porosity of 20-30%. However, this process isn’t always great for advanced geometry that one might find in a injection mold. Thus, the creation of breathable rods and bars that can be used as an insert in a larger mold, acting as a localized vent. It’s a useful technique, but comes with more constraints on mold and part geometry than being able to simply create the whole mold itself out of breathable steel.

There are other powder metal techniques that allow the production of more complex vented parts, but they can be expensive and difficult to execute well down to smaller pore sizes, especially compared to the simplicity of SLM printing with an additional foaming agent. The 3D-printing based process has also proven to have more admirable mechanical properties compared to products like PM-35 steel in some cases, with impressive compressive strength as well as hardness and corrosion resistance.

Breathable steel is probably not something you’ll come across in your everyday life unless you happen to work in particular manufacturing fields. Still, if you have the expensive 3D printing hardware on hand to work with metal powders, and you really want to make a complex metal part that’s also porous, this is a great way to go. You could probably use it to make some very weird magic tricks at the very least. Ultimately, it just goes to show that modern material processing techniques can upend everything we think we know about a common material like steel. It’s amazing what can be done!

That’s down from the previous 2,400 posts per day limit.

Grafana Labs disclosed that hackers have downloaded its source code after breaching its GitHub environment using a stolen access token.

A relatively new extortion gang known as CoinbaseCartel has claimed the attack by adding Grafana to their data leak site (DLS), although no data has been leaked yet.

Grafana Labs is the company behind Grafana, the popular open-source platform for analytics, monitoring, and real-time data visualization.

Paying customers are primarily large enterprises, cloud providers, telecos, banks, governments, e-commerce platforms, and infrastructure operators. According to Grafana, more than 7,000 organizations use the product, including 70% of the Fortune 50 companies.

No payment for hackers

In an announcement over the weekend, Grafana Labs said that its investigation found no evidence that customer data or personal information was exposed during the incident. Furthermore, the company notes that customer systems remained unaffected.

The forensic analysis revealed the source of the leaked credentials. The company “invalidated the compromised credentials and implemented additional security measures” to prevent future unauthorized access.

The attacker attempted to extort the company, demanding payment in exchange for not publishing the stolen source code. However, Grafana said it chose to follow public guidance from the Federal Bureau of Investigation (FBI) and not pay the ransom, noting that doing so would only encourage other threat actors to pursue similar attacks.

“Based on our operational experience and the published stance of the FBI, which notes that paying a ransom doesn’t guarantee you or your organization will get any data back and only offers an incentive for others to get involved in this type of illegal activity, we’ve determined the appropriate path forward is not to pay the ransom,” Grafana stated.

The company said it would release more details about the attack after completing its post-incident investigation.

BleepingComputer has contacted Grafana with a request for additional details about the breach, but we have not received a response by publishing time.

CoinbaseCartel escalates activity

The CoinbaseCartel launched last September and has been quite active this year, announcing more than 100 victims on its data leak portal. The gang focuses on data theft and uses the DLS to pressure victims into paying a ransom.

The gang announced on its site that they “are behind on many leaks,” indicating increased breaches that may have yet to reach the public space.

According to multiple researchers, CoinbaseCartel consists of ShinyHunters and Lapsus$ affiliates that gain access to target networks via social engineering, various forms of phishing, and compromised credentials.

Threat intelligence specialist Joe Shenouda claims that the gang also deploys an in-memory tool called “shinysp1d3r” to encrypt VMware ESXi targets and disable snapshots.

Last year, BleepingComputer analyzed a ShinySp1d3r Windows encryptor developed by the ShinyHunters extortion group. At the time, the threat actor said that they were working on finishing encryptor versions for Linux and ESXi.

After publishing this article, the ShinyHunters extortion gang told BleepingComputer that the CoinbaseCartel is not linked to their group or ransomware operation.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Advertisement

Download Now