Vulnerability

Anthropic has built its brand on safety. Claude is consistently positioned as the thoughtful, cautious model — the one that pushes back on dangerous requests, that thinks about consequences, that errs on the side of care. So the DryRun Security research published today will raise some eyebrows: when used as an agentic coding agent building real applications, Claude produces the highest number of unresolved high-severity security flaws among the leading AI coding agents tested. ...

DryRun Security’s 2026 Agentic Coding Security Report found that Claude, when operating as an autonomous coding agent, produces more unresolved high-severity security flaws than Codex or Gemini. But here’s the thing: all AI coding agents produce security vulnerabilities. The model matters less than your review process. This guide walks you through a practical security audit workflow for AI-generated code, applicable regardless of which model or agent you’re using. Before You Start: Understand the Risk Profile AI-generated code has specific vulnerability patterns that differ from human-written code. Knowing what to look for saves time. ...

DryRun Security’s 2026 Agentic Coding Security Report landed a finding that should make every engineering team pause: 87% of pull requests written by AI coding agents (Claude, Codex, Gemini) introduced at least one security vulnerability. Not occasionally — consistently, across all three leading models, in real application development scenarios. This isn’t a reason to stop using AI coding agents. The productivity gains are real. But it is a strong signal that AI-generated code needs a security review process as rigorous as — or more rigorous than — what you’d apply to human-written code. ...

OpenAI is entering the enterprise security market in a serious way. On March 6, 2026, the company launched Codex Security — an AI security agent in research preview that doesn’t just find vulnerabilities, but confirms them with proof-of-concept exploits and proposes developer-ready patches. The agent was previously codenamed “Aardvark.” The new name signals intent: this is Codex — OpenAI’s flagship agentic coding system — applied specifically to the application security workflow. ...

If you run OpenClaw on your local machine, here’s your mandatory security update for the week: a vulnerability named ClawJacked was quietly exploiting a gap in the local gateway WebSocket handshake — and yes, a malicious website could have used it against you while you were browsing with OpenClaw running in the background. The patch is out. Here’s what happened and what you need to do. What Is ClawJacked? ClawJacked is the name given to a class of attack discovered by Oasis Security that targets OpenClaw’s local gateway server — the WebSocket service that runs on localhost to connect your browser to your AI agents. ...

Oasis Security disclosed a critical vulnerability chain in OpenClaw today that can enable full workstation compromise — initiated from a browser tab. SecurityScorecard found more than 40,000 OpenClaw gateways exposed to the public internet. If you’re running OpenClaw, this guide walks you through auditing your exposure and locking it down while you wait for an official patch. This is not a theoretical threat. Act now. Disclaimer: This guide reflects best practices as of 2026-02-26, based on the publicly available Oasis Security threat research. OpenClaw’s security team has acknowledged the report. Apply any official patches immediately when released, as they may supersede or extend these mitigations. ...

If you’re running OpenClaw, stop what you’re doing and read this. Oasis Security’s research team published threat research today revealing a critical vulnerability chain in OpenClaw that enables attackers to achieve full workstation compromise — potentially including privilege escalation and credential theft — initiated entirely from a browser tab. This is a distinct and separate issue from the GHSA-mr32 CVE batch that was patched earlier this month. Compounding the urgency: SecurityScorecard has identified more than 40,000 exposed OpenClaw instances accessible from the public internet. ...

OpenClaw Security Crisis: Six CVEs Patched, 40K Instances Exposed, and NanoClaw Rises Today is a tough day for OpenClaw’s security reputation — and an important one for anyone running the framework. Three interconnected stories broke simultaneously, painting a picture of an ecosystem under pressure: six newly-disclosed vulnerabilities, 40,000+ publicly exposed instances, and the rapid rise of a minimalist, security-first alternative called NanoClaw. Here’s the full picture, and what you need to do right now. ...