News – Page 3 – Forkast

Agents at Home

Apple Sues OpenAI to Stall Its Smart Home Push — While Its Own AI Hub Sits in Warehouses

A trade secret lawsuit targets OpenAI's smart speaker plans, but Apple's HomePad is stuck waiting on Siri AI, which now runs on Google Gemini. The $250M settlement adds a harm frame.

◆ Mila CohenJul 11

Trust & Security

HalluSquatting Turns AI Hallucinations Into a Deterministic Supply Chain Attack — 85% Hit Rate

Researchers demonstrate that AI coding assistants hallucinate the same fake package names with up to 85% consistency across models, allowing attackers to pre-register malicious versions. The technique, dubbed HalluSquatting, escalates hallucination from a reliability problem to a weaponized supply chain attack.

◆ Heath CallahanJul 11

Trust & Security

GhostApproval: Symlink Flaw Tricks 6 AI Coding Assistants Into Writing to SSH Keys — Anthropic Disputes, Then Ships Its Own Fix

Wiz Research discloses a category-level vulnerability in AI coding assistants where malicious symlinks bypass approval dialogs to write to sensitive system files. Five of six vendors fixed or acknowledged. Anthropic was the sole disputer — despite having already shipped a preemptive patch.

◆ Heath CallahanJul 11

Trust & Security

Langflow Becomes First AI Agent Platform Added to CISA’s Exploited Vulnerabilities Catalog — Federal Deadline Is Today

CVE-2026-55255, a cross-tenant IDOR in Langflow's /api/v1/responses endpoint, triggers a 3-day federal remediation window under BOD 26-04. Sysdig TRT documented attackers chaining it with an older RCE for credential harvesting.

◆ Heath CallahanJul 10

Agents at Home

Meta’s Ray-Ban Glasses Now Disable Their Camera If You Tamper With the Privacy LED — and California Wants to Codify That Into Law

A mandatory firmware update permanently kills the camera on tampered second-gen Ray-Ban Meta glasses. California's SB 1130 would make disabling the recording indicator a crime. The two forces arrived in the same week.

◆ Mila CohenJul 10

Trust & Security

Researchers Weaponize AI Hallucinations Into Supply Chain Attack — 85% Hit Rate on Package Names

HalluSquatting technique turns predictable AI coding assistant hallucinations into a botnet delivery mechanism. Affects Cursor, Windsurf, Copilot, Cline, Gemini CLI, OpenClaw.

◆ Heath CallahanJul 10

Trust & Security

Symlink Trick Bypasses Approval Safeguards in 6 Major AI Coding Assistants — SSH Keys at Risk

Wiz Research discloses GhostApproval — a symlink-following flaw that tricks approval dialogs into hiding the true write target. Three vendors patched. Anthropic disputes the classification.

◆ Heath CallahanJul 10

Money & Markets

The CBDC Ban Just Took Effect Without a Signature. Private Stablecoins Win the Digital Dollar Race by Default.

H.R. 6644 has effectively enacted itself through constitutional procedure, prohibiting the Federal Reserve from issuing a CBDC through 2030. Combined with the GENIUS Act, private stablecoins are now the only digital dollar option for AI agent payment infrastructure.

◆ Nolan PrattJul 10