Security & Governance
Claude Code 2.1.268 patches silent deny-rule bypasses and MCP secret leakage
Claude Code 2.1.268 fixes silent security boundary failures via symlinks and shell commands, plus stops MCP configs leaking secrets in plaintext.
Topic
Security
16 posts about Security from Simon Carter.
.png)
Security & Governance
Google Workspace admins can now use context-aware access policies to control Gemini Enterprise sign-in
From 8 September 2026, Gemini Enterprise admins can apply CAA policies to restrict who authenticates into Gemini based on device, location, and more.
Security & Governance
Claude Enterprise adds beta security scanning for third-party skills and plugins
Claude Enterprise admins can now enable automatic security scanning for third-party skills and plugins, catching malicious content at upload or edit.
Developer Tools & APIs
OpenAI's Secure MCP Tunnel lets private servers talk to ChatGPT without opening your firewall
OpenAI's GA Secure MCP Tunnel uses an outbound-only tunnel-client daemon so private MCP servers can serve ChatGPT, Codex, and the Responses API with no inbound firewall rules.
Security & Governance
Claude's 'Share' Feature Was Quietly Publishing Conversations to Google Search
A missing noindex tag meant shared Claude chats were publicly discoverable on Google, exposing legal advice, API keys, and crypto wallet credentials.
Security & Governance
Claude now integrates with 28 enterprise security platforms — here's what that means for IT and compliance teams
Anthropic's Compliance API now connects Claude Enterprise to 28 security platforms including Palo Alto Networks, Rubrik, Okta, and Sumo Logic.
Developer Tools & APIs
Claude Code v2.1.178: Precise Tool Permissions, Smarter Config Resolution, and Safer Sub-Agents
Claude Code's latest release adds parameter-level permission syntax, proximity-based .claude/ directory resolution, and pre-launch safety screening for sub-agents.
Developer Tools & APIs
GitHub Copilot CLI v1.0.72 & v1.0.73: Critical Infinite-Loop Fix and Sandbox Security Tightening
Two back-to-back Copilot CLI releases fix a dangerous agentStop infinite-loop bug, tighten macOS sandbox defaults, and patch Anthropic subagent reliability.
Security & Governance
OpenAI Doubles the Bio Bounty Reward to $50K and Makes the Program Permanent — Here's What Changed on July 9
OpenAI upgraded its Bio Bug Bounty to an ongoing private program on July 9, adding GPT-5.6 to scope and doubling the reward to $50,000.
Security & Governance
Anthropic confirms hidden tracking mechanism in Claude Code after China's national vulnerability database issues formal security advisory
Claude Code versions 2.1.91–2.1.196 contained an undisclosed monitoring mechanism. Here's what it did, who's affected, and what to do now.
Security & Governance
Claude Managed Agents can now store API keys in a vault — and the agent never sees them
Anthropic's vault-stored environment variables let Claude Managed Agents authenticate CLI tools without the API key ever entering the agent's context window.
Agents & Automation
Anthropic's Managed Agents now run on a schedule and store credentials securely — no custom plumbing required
Anthropic's public beta adds cron-based scheduling and a network-boundary credential vault to Claude Managed Agents, removing two common DIY infrastructure headaches.
Security & Governance
ChatGPT Lockdown Mode is now available to personal accounts — here's what it does and who needs it
OpenAI's Lockdown Mode, a security setting that blocks live web access and agentic features to defend against prompt injection, is now available to all personal ChatGPT plans.
Developer Tools & APIs
Codex CLI Gets Session Archiving, Clickable Terminal Links, and Safer Remote Control
The latest Codex CLI update adds session archiving, OSC 8 hyperlinks in TUI markdown, richer MCP status, and short-lived WebSocket tokens for remote control.
Security & Governance
Anthropic tracked 832 malicious accounts for a year. The MITRE ATT&CK framework can't fully describe what it found.
Anthropic's Frontier Red Team mapped 13,873 real attacks to MITRE ATT&CK — and found the framework has no ID for the autonomous agentic behavior defining the highest-risk actors.
Security & Governance
Codex CLI 0.137.0: Git Hook Blocking, WebSocket Hardening, and Windows Sandbox Setup
Codex CLI 0.137.0 closes three command-safety gaps and adds an alpha Windows elevated sandbox provisioning path for admins.