7 min read
Three Things That Broke When Anthropic Pulled the Internet From Its Own Evals
On October 9th, Anthropic disclosed that it has removed live internet access from all internal evaluations because it cannot reliably control unintended…
Mo Wasay
4 min read
Did a Workflow You Trusted Just Exfiltrate Your Secrets?
Attackers compromised maintainer accounts on 340+ repositories and inserted malicious GitHub Actions workflows that steal secrets during CI runs. If your pipeline…
6 min read
One Toggle, Five Years Late: Send From Alias Finally Goes GA
Microsoft's send-from-alias feature sat in preview long enough that thousands of shared mailboxes exist only to work around it. Here's what general…
3 min read
I Went Hunting for TrustSink in My Tenant—Four Old Attacks, New Name
When a new attack name drops, I audit my tenant first and the hype second. TrustSink turned out to be four well-known…
9 min read
Why Did Every Pod on That Arc Cluster Stop Getting Its Secrets?
Microsoft is retiring the Secrets Provider extension for Arc Kubernetes clusters in October 2027. The replacement isn't a drop-in swap — it's…
7 min read
The BI Ticket Is Dead. The Warehouse Credential Is the New Attack Surface
Anthropic's Dashboards beta collapses the two-week BI ticket into a sentence. It also collapses your access review into a credential you hand…
4 min read
“I Archived That in 2018″—So Why Is Copilot Quoting It Back to Me?
Archive mailboxes aren't cold storage—Microsoft Search indexes them just like primary mailboxes, which means Copilot has full access to every email your…
5 min read
AKS Now Defaults New Clusters to StandardV2 NAT Gateway—Check the Cost
Microsoft changed the default NAT Gateway SKU for new AKS clusters, and the new one bills per gateway-hour plus per gigabyte of…
7 min read
App Store Connect API 4.5.1 Touches Nothing Your Identity Stack Depends On
No change to Sign in with Apple's token endpoints, App Attest, or signing requirements. But the reflex to skim and assume it…
4 min read
Domain Validation Is Dead. Certificate Transparency Won.
Attackers took over three country-code domain registries and issued valid HTTPS certificates for Google domains. Every validation method the CAs checked passed—because…