Dennis Andrade

identity-security

Hackers Shipped a Backdoored Claude Code Update. It Had Anthropic's Real Name on It.

Nov 3, 2026

•

3 min read

Hackers Shipped a Backdoored Claude Code Update. It Had Anthropic's Real Name on It.

The name on the update was real. The update wasn't. Now ask what that means for every AI tool you let into your computer.

Dennis Andrade

identity-security

One Saved Password Just Dumped 594,000 Florida DMV Files Online

Oct 27, 2026

•

4 min read

One Saved Password Just Dumped 594,000 Florida DMV Files Online

Florida blames one police employee's login. The real problem is every agency holding a key to your driver record.

Dennis Andrade

Microsoft 365

More Than 160 Companies Got Hacked by an App They Forgot They Approved

Oct 20, 2026

•

3 min read

More Than 160 Companies Got Hacked by an App They Forgot They Approved

No password. No MFA. No person. One stolen app key opened at least 162 companies’ email, and many of them may never know what was read.

Dennis Andrade

OpenAI

Oct 13, 2026

•

3 min read

AI Isn’t Rogue. It Has Your Keys.

OpenAI’s models broke into Hugging Face with no malicious intent. The real failure was the access left lying around.

Dennis Andrade

identity-security

France's Tax Office Got Robbed With 30 Passwords. It Found Out When the Thief Bragged.

Oct 6, 2026

•

3 min read

France's Tax Office Got Robbed With 30 Passwords. It Found Out When the Thief Bragged.

No zero-day. No genius. Just stolen passwords, missing MFA, and alarms nobody connected. Here's what France's official post-mortem reveals.

Dennis Andrade

Zero Trust

This Malware Has No Boss. Four AIs Vote on What It Steals Next

Sep 29, 2026

•

4 min read

This Malware Has No Boss. Four AIs Vote on What It Steals Next

CLOSEDQUORUM skips the command server entirely. It asks DeepSeek, Qwen, Mistral and Gemini what to do, and majority rules.

Dennis Andrade

Zero Trust

Someone Just Let an AI Agent Hack Into a Database Completely on Its Own

Sep 22, 2026

•

3 min read

Someone Just Let an AI Agent Hack Into a Database Completely on Its Own

Spain's data protection agency logged the first confirmed data breach carried out entirely by an AI agent — login, recon, exploitation, and data access, with no human steering any of it.

Dennis Andrade

patch management

AI Agents Just Broke Into 440 Companies in 48 Hours

Sep 15, 2026

•

3 min read

AI Agents Just Broke Into 440 Companies in 48 Hours

A Russian-speaking threat actor pointed a swarm of AI agents at one PaperCut vulnerability — and beat human defenders to the finish line.

Dennis Andrade

Software Supply Chain

Someone Just Minted Themselves Admin Access to Thousands of Companies

Sep 8, 2026

•

4 min read

Someone Just Minted Themselves Admin Access to Thousands of Companies

A JFrog Artifactory bug lets attackers skip login entirely — and mint admin tokens for the software supply chain thousands of companies run on.

Dennis Andrade

Software Supply Chain

Someone Just Used AI to Break Into 10 Companies

Sep 1, 2026

•

3 min read

Someone Just Used AI to Break Into 10 Companies

A ransomware crew turned a free coding assistant into an attack tool — and it never knew the difference.

Dennis Andrade

tiktok

Aug 28, 2026

•

8 min read

I Won't Let My Kids on TikTok, Instagram Roblox. Here's the $400 Million Reason Why

An extra issue, off the usual format — on TikTok's $400M fine, Meta's $17.1B settlement, the Roblox lawsuits, and why I think age verification should be a condition of doing business, not a roadmap item.

Dennis Andrade

meta-hacking

Aug 25, 2026

•

3 min read

Your AI Assistant Is Spying for Strangers

Researchers turned Microsoft Copilot into a full reconnaissance tool using nothing but polite, innocent-sounding questions — and any AI assistant with broad access could do the same.

Dennis Andrade

Software Updates

Firefox's Master Key Was Sitting on GitHub

Aug 18, 2026

•

3 min read

Firefox's Master Key Was Sitting on GitHub

The signature that proves a Firefox update is real got exposed — and there's no way to know who saw it

Dennis Andrade

Account Takeover

Aug 11, 2026

•

3 min read

Your AI Login Isn't Yours Anymore

Stolen and resold AI accounts are turning shared logins into a surveillance channel nobody notices

Dennis Andrade

Microsoft Copilot

Aug 4, 2026

•

3 min read

Your Copilot Caught a Virus

A hidden instruction in one Word file just proved AI assistants will infect every document they touch next.

Dennis Andrade

Zero Trust

Your AI Code Reviewer Just Approved Malware It Never Saw

Jul 28, 2026

•

5 min read

Your AI Code Reviewer Just Approved Malware It Never Saw

A hidden comment in a pull request is all it takes to hijack the AI gatekeeper your team trusts to ship safe code

Dennis Andrade

identity-security

The Email That Convinced Your AI You're Allergic to Penicillin

Jul 21, 2026

•

3 min read

The Email That Convinced Your AI You're Allergic to Penicillin

One email is all it takes to plant a permanent lie in your AI assistant's memory — and there's no patch coming, because it isn't a bug.

Dennis Andrade

NHI

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

Jul 14, 2026

•

4 min read

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in

Dennis Andrade

Microsoft 365

Jul 7, 2026

•

3 min read

You Just Gave Microsoft Permission to Let Strangers Into Your Account. It Took Three Seconds

ConsentFix and ClickFix attacks are turning OAuth consent prompts into skeleton keys — no password theft, no MFA bypass required. Here's how they work and what to revoke today.

Dennis Andrade

third-party integrations

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Jun 30, 2026

•

5 min read

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Malicious code is now delivered as helpful app features — and 26,000 AI agents just installed one.

Dennis Andrade

authentication

Your Password Is Safe. You're Still Getting Hacked

Jun 23, 2026

•

4 min read

Your Password Is Safe. You're Still Getting Hacked

The attack that broke Microsoft's login doesn't need your password at all.

Dennis Andrade

defense evasion

The Security Camera Footage of Your Digital Life Is Being Erased While You're Being Robbed

Jun 16, 2026

•

4 min read

The Security Camera Footage of Your Digital Life Is Being Erased While You're Being Robbed

Attackers aren't breaking in anymore. They're deleting the evidence that they were ever there.

Dennis Andrade

identity

The Security Experts Protecting America Just Got Caught Doing the Thing They Tell You Never to Do

Jun 9, 2026

•

3 min read

The Security Experts Protecting America Just Got Caught Doing the Thing They Tell You Never to Do

CISA left government cloud keys in public GitHub. Microsoft shipped a debug flag to 3 billion phones. Meta's AI gave away Instagram accounts. Same week.

Dennis Andrade

identity-security

Jun 2, 2026

•

4 min read

Ransomware Doesn't Break In. It Logs In

The forensics always leads back to the same place — an account that shouldn't have existed, with access it shouldn't have had. Here's what to fix before the 2 AM alert.

Dennis Andrade

Credential Security

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

May 26, 2026

•

4 min read

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

CISA left live AWS GovCloud credentials in a public repo named "Private." It sat there for six months. Nobody inside the agency noticed.

Dennis Andrade

Dennis Andrade

Hackers Shipped a Backdoored Claude Code Update. It Had Anthropic's Real Name on It.

One Saved Password Just Dumped 594,000 Florida DMV Files Online

More Than 160 Companies Got Hacked by an App They Forgot They Approved

AI Isn’t Rogue. It Has Your Keys.

France's Tax Office Got Robbed With 30 Passwords. It Found Out When the Thief Bragged.

This Malware Has No Boss. Four AIs Vote on What It Steals Next

Someone Just Let an AI Agent Hack Into a Database Completely on Its Own

AI Agents Just Broke Into 440 Companies in 48 Hours

Someone Just Minted Themselves Admin Access to Thousands of Companies

Someone Just Used AI to Break Into 10 Companies

I Won't Let My Kids on TikTok, Instagram Roblox. Here's the $400 Million Reason Why

Your AI Assistant Is Spying for Strangers

Firefox's Master Key Was Sitting on GitHub

Your AI Login Isn't Yours Anymore

Your Copilot Caught a Virus

Your AI Code Reviewer Just Approved Malware It Never Saw

The Email That Convinced Your AI You're Allergic to Penicillin

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

You Just Gave Microsoft Permission to Let Strangers Into Your Account. It Took Three Seconds

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Your Password Is Safe. You're Still Getting Hacked

The Security Camera Footage of Your Digital Life Is Being Erased While You're Being Robbed

The Security Experts Protecting America Just Got Caught Doing the Thing They Tell You Never to Do

Ransomware Doesn't Break In. It Logs In

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

STAY CONNECTED