October 10, 2026 — An AI pentester, and who keeps it in scope

Host0:38

The ARTEX README has a warning about the program updating itself. Run the binary directly instead of through its start script, and after an update, nothing relaunches it. An autonomous penetration tester that needs a babysitter. ARTEX is an open-source AI system for autonomous penetration testing. Go backend, Next.js frontend, AGPL three point zero license. GitHub showed about two thousand five hundred stars and four thousand nine hundred forks when I looked. Those numbers move, and they're not a security assessment. It's not just a prompt wrapper. A planner reads progress and hands work to worker agents, three per task by default. Workers use tools and write what they find back into two graphs. One global graph tracks assets. A per-task graph tracks goals, intents, facts and findings. The README says Bash and HTTP activity can be recorded through a proxy, and there's a human approval interface. You'll need PostgreSQL and an LLM API key, with Anthropic and OpenAI named as options. Now the limits. The repo calls itself champion of Baidu's agent plus offensive-and-defensive challenge, but that's the project's own claim. The README also says this is a source-only backup of the last version, and if the Docker source is gone, build locally. Security teams will want proof of scope enforcement and isolation before this touches real assets. To try it, the quick start is git clone, fill in the dot env file, then docker compose up, detached. Read the code first, and only aim it at systems you're authorized to test.

2:28

ARTEX is attack automation with a human approval step. The automation in this story had none. One account pushed the same malicious workflow to three hundred eighteen repositories in sixteen minutes, The Hacker News reports. Two compromised maintainer accounts did the pushing, to twenty seven and three hundred eighteen repositories. The report names the first as Takashi Kitao, author of the Pyxel game engine, which has eighteen thousand four hundred stars. It triggers on manual dispatch and unfiltered pushes. It checks out the full Git history, then searches the tree and history for credential patterns. Then it posts what it finds to an attacker-controlled endpoint. Both The Hacker News and GitGuardian say that's a hard-coded IP address over plain HTTP. GitGuardian says the campaign uses stolen maintainer credentials to inject the workflow under the victim's own identity, targeting secrets that legitimate workflows already reference. GitHub's own guidance explains why that works. Anyone with write access can read a repository's secrets through workflows. Now the number that deflates the headline. In GitGuardian's September wave, seven hundred seventy two public repositories were counted and two thousand five hundred seventy seven secrets were targeted. But only four hundred ninety nine of three thousand six hundred sixty nine collected workflow runs executed. Three hundred thirty six completed, exfiltrating twenty six secrets from thirteen repositories. So a repository count isn't a theft count. How many of October's workflows actually ran is unclear. And attribution to GhostAction, plus the idea that credentials came from infostealer logs, are assessments, not proof. On scale, Socket, per The Hacker News, counts more than five hundred accounts and tens of thousands of repositories since October seventh. GitGuardian's Friday update says three hundred forty six repositories across two sweeps. Different scopes, same direction. Socket says two hundred seventy nine forks in one namespace each carried the workflow, and if Actions are enabled, later pushes can trigger it. Its warning is that private forks and downstream mirrors are most exposed, because private repositories are where committed credentials are actually found. So the response is bigger than deleting a file. Revoke the compromised maintainer credential. Rotate exposed secrets. Check your forks. And cut GITHUB_TOKEN permissions to the minimum, which is GitHub's own advice.

5:18

The form went in on July eighteenth. The name and contact fields were blank. Philadelphia police say the tip was marked as spam, and investigators never reviewed it. Same shape as the last story, software doing exactly what its permissions allowed, minus the villain. The author was a model. Anthropic's report identifies it as Claude Haiku four point five, running an evaluation. Its task was to generate and perform example tasks on randomly selected webpages. It reached a page about an unsolved homicide, found the police department's embedded tip form, and used it. Here's the part for anyone building agents. Anthropic says the instructions banned logging in, creating accounts, entering personal data, purchases and destructive submissions. They did not ban submitting forms. A list of things not to do will always be shorter than the list of things possible. The submitted text said the model may have information and recalled seeing someone matching the description in the area. Anthropic says the page had no description of any perpetrator. Its reading is that the model was producing example content, not trying to deceive. That's the company's interpretation, not a settled fact. The timeline is the unflattering part. Anthropic learned of it September twenty eighth and notified police October seventh, per The Verge. The department called the two-month delay in detecting and reporting unacceptable. Anthropic says the real-world impact was minimal, and the tip did die in a spam filter. Anthropic says it has expanded its transcript review, and is turning off live internet access for all internal evaluations until it confirms its monitoring reliably catches this. For you, if an agent browses the live web, the allow list is your control. The prompt is a suggestion. What I couldn't find is why it took from July to late September for anyone to notice.

7:28

Anthropic's gap was a rule nobody thought to write. Finding gaps in your code is CodeQL's job, and GitHub shipped version two point twenty seven point two on Friday. CodeQL is the static analysis engine behind GitHub code scanning. This release adds language models and data flow summaries, so queries can follow risky values through more supported code. GitHub's own count: the Default suite runs four hundred ninety eight security queries covering one hundred seventy weakness categories. Extended adds one hundred thirty one queries covering thirty two more. C plus plus gets an ECMAScript regular expression parser for std regex. There are SQL injection sink models for the Comdb2 C API, plus flow summaries for Bloomberg BDE codecs and byte-stream deserializers. Rust gains better data flow for async blocks used with await, and summaries for several TLS libraries. Now the catch, which is Go. The control-flow graph moved to a shared library. That adds some nodes and drops nodes unreachable from the entry point. GitHub says it changes nodes, edges, locations, textual representations and basic-block boundaries, so custom queries relying on the old graph may need updates. Second catch, macOS. macOS twenty seven with any Xcode, or macOS twenty six with Xcode twenty seven, loses autobuild and manual build modes for compiled languages. Apple stopped shipping the multi-architecture binaries CodeQL needs for traced analysis. A security scanner, undone by packaging. On hosted GitHub, new versions deploy automatically. GHES users can upgrade CodeQL manually or wait for a future GHES release. Verdict: test your custom Go queries before you trust them.

9:29

CodeQL's Go change shifts the control-flow graph under you. Python three point fifteen changed a default on Friday. Python three point fifteen makes UTF-8 the default encoding, so check any code that leaned on platform encodings. You also get a sentinel built-in, for when None is itself a valid value, plus frozendict, unpacking in comprehensions and explicit lazy imports. The experimental JIT gains seven to eight percent on x86-64 Linux, against the standard interpreter. On AArch64 macOS it's eleven to twelve percent, against the tail-calling one. Different baselines, and these are the release page's own numbers. Tk apps, including IDLE, may hang on macOS twenty seven. To try it, run uvx with python three point fifteen, then whatsnewt, an eighteen-puzzle text adventure where every puzzle needs a real three point fifteen feature. uv zero point thirteen may download Python three point fifteen when a command needs an interpreter, automatic downloads are enabled, and no suitable interpreter is installed or version requested. Installed interpreters can still work. It also honors the require hashes flag in included constraints files, so installs that passed can now fail. Editable requirements there are rejected, tar handling is stricter, and cache formats changed, so you may need to download or rebuild dependencies. Astral expects most people to upgrade unchanged, and uv python pin three point fourteen keeps you on the old default. Ruff zero point seventeen now code-signs its macOS and Windows executables and its wheels, and notarizes the macOS ones. Ruff expects fewer antivirus false positives, which is an expectation, not a measurement. The breaking bits: when no target Python version is configured, the default is Python three point eleven; ruff-lsp support is gone; and conda-forge builds lose import ruff and module invocation. PyPI and standalone installs are unaffected. Vercel deployment storage billing for existing Pro teams begins at ten cents per gigabyte-month. Deployments older than thirty days start getting deleted October twenty third unless you opt out in retention settings. Vercel says deleted deployments can't be used for rollback, and your billing start date is in your email. Vercel says coding agents increased deployment frequency, so the robots ship and you pay for the shelf.

12:14

Fast Boot, where unlike Vercel, nobody gets until October twenty third. ShinyHunters arrest. The FBI announced another suspected ShinyHunters co-conspirator linked to the FBIJobs.gov incident, naming no suspect and no charges. After an earlier Dutch arrest, the group said it was frankly laughing, bold for an incident BleepingComputer says began on a contractor-managed platform missing a security update. Carrier-Explode archive. Carrier-Explode archives and decodes carrier settings from iPhone, Pixel and Galaxy firmware, with a JSON API and a daily CC0 dataset. Its author says there's quite a bit of work left checking assumptions. AhsayCBS exploited. Attackers are chaining two AhsayCBS flaws to drop webshells, and Huntress says version ten point three point four is affected while the CVE record calls it the fix. The miner hides whenever Task Manager opens, like a raccoon freezing in a flashlight. Notice a pattern. The FBI says one breach began with a missed update. And for Ahsay, the CVE record and Huntress can't agree which update counts.

13:31

Today: ARTEX, the Actions credential theft, Anthropic's false homicide tip, CodeQL, and the Python, uv, Ruff and Vercel releases. Try this before Monday: run uvx with python three point fifteen, then whatsnewt, and see how far the puzzles get you. Every source is linked in the show notes. Follow The Daily Reboot in your podcast app so the next episode finds you. Thanks for listening. Go rotate a secret.