Security

Dreeze launches with $33M to recover entire cloud applications, not just their data (opens siliconangle.com)

Dreeze's 'Application Revival' restores whole cloud applications after an outage, not only their data.

AI-driven managed security startup Daylight raises $80M on 40-fold revenue growth (opens siliconangle.com)

The WSJ says Goldman Sachs Alternatives led the Series B at a ~$400M valuation; Daylight says revenue grew more than 40-fold in a year.

Fireworks AI security breach impacts Notion and their customers (opens notion.com)

Notion's own incident notice on a breach at AI vendor Fireworks that affected Notion and its customers.

AI security startup Bay launches with $50M to vet agent actions before they run (opens siliconangle.com)

Bay lets enterprises vet each action an AI agent tries to take before it runs.

Google Gemini routes personal Drive files and emails to human annotators (opens github.com)

A GitHub write-up claims Gemini sends personal Drive files and emails to human annotators; Google has not confirmed the claim in the source.

ChatGPT Desktop forwards your SSH agent to remote machines (opens news.ycombinator.com)

The agent running on a remote machine can authenticate using your local SSH credentials. That means it can push to your private repos on GitHub, for example. Proof: https://github.com/openai/codex/pull/28131#discussion_r3410013180

AI infrastructure provider Fireworks says hackers accessed some customers' datasets, incomplete model weights, and billing information (opens forbes.com)

AI infrastructure provider Fireworks says hackers accessed some customers' datasets, incomplete model weights, and billing information over the past month — Two customers told Forbes they had already substantially moved their business off Fireworks' systems, with one describing a series …

IBM plans to bring Anthropic’s Claude Mythos to enterprise customers (opens thenextweb.com)

IBM will put Claude Mythos in Concert Protect for vulnerability scanning; TNW separately reports Cisco adding it to AI Defense for red teaming.

THORChain, which handled ~$1B of stolen Bybit funds in 2025 for $12M+ in fees, began moving the Binance loot despite FBI pleas (opens wsj.com)

THORChain, which handled ~$1B of stolen Bybit funds in 2025 for $12M+ in fees, began moving the Binance loot despite FBI pleas, saying it can't stop transfers — Some crypto developers say they can't stop North Korean hackers from laundering stolen funds through their platforms, frustrating law…

He arrested a hacker, then spent 18 months clearing his own name. Now he’s a cybersecurity VC. (opens techcrunch.com)

Stephen Ward, a former Secret Service agent and Home Depot CISO, is preparing a second fund of roughly $250 million.

Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files (opens apiiro.com)

Show HN: Coldframe, a honeypot that poses as a supermarket fridge controller (opens github.com)

A Show HN honeypot that poses as a supermarket refrigeration controller, built after recent attacks on industrial fridge installations.

Megaspeed exec was recruited to spy on Nvidia CEO, according to US intelligence memo (opens techcrunch.com)

A memo circulated earlier this year reportedly claimed that China’s Ministry of State Security recruited a female technology executive to spy on Nvidia's CEO.

Hundreds of Artex AI hacking tools found publicly exposed to the web (opens techcrunch.com)

Security researchers found hundreds of servers hosting the penetration testing tool Artex exposed to the internet, allowing anyone access to the hacking tool.

Partnering with Hacktron to find vulnerabilities in OpenAI’s systems (opens openai.com)

OpenAI is partnering with Hacktron to find vulnerabilities, test connections with third-party services, and strengthen defenses with frontier AI.

Atomicwork launches certified AI coworker marketplace for enterprise IT and security (opens siliconangle.com)

Information technology service management startup Atomicwork Inc. today announced the launch of an Artificial Intelligence Coworker Marketplace that will give enterprise IT and security teams access to prebuilt, certified AI coworkers that can work alongside employees.

Defense in Depth, Rebuilt for Machine Speed (opens a16z.news)

Six generational opportunities we see

Palo Alto Networks in talks to buy AI agent security startup Clutch for $500M (opens techcrunch.com)

Clutch, backed by Lightspeed and SignalFire, was last valued at $85 million, according to a source.

Show HN: Agentic Identity Broker, OAuth Delegation for AI Agents (opens github.com)

An MIT-licensed OAuth2 broker from the Zalando Incubator that lets a user give an AI agent scoped access.

A $90 Key into Your Company's Secrets (opens tomtunguz.com)

The cost of an autonomous 32-step corporate break-in fell 99% in five months from $7,500 on Claude Mythos Preview in April 2026 to $90 on open-weight GLM-5.3. Attackers run an expected-value calculation on AI compute ($1m of compute for a 1% shot at a $1b payout yields $10m in expected value)…

Sources: cloud security startup Cyera is planning to raise around $800M in a round led by Cyberstarts at a $20B valuation, up from $12B in June (opens theinformation.com)

The Information reports a raise at a $20B valuation, up from $12B in June.

Claude Code sends your email address to websites (opens github.com)

GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents (opens openai.com)

OpenAI's cybersecurity model, a version of GPT-6 Astra, finds exploitable vulnerabilities and develops fixes while staying within authorized scope.

The ex-Secret Service agent who flipped a hacker is now raising a second $250M cybersecurity fund (opens techcrunch.com)

Stephen Ward, a former Secret Service agent and Home Depot CISO, is preparing a second fund of roughly $250 million for Brightmind Partners.

The Exploit Was the Bottleneck (opens a16z.news)

What 23 Years of Data Say About AI and the Patch Gap

AI is forcing us to pay off 40 years of technical debt (opens spectrum.ieee.org)

OpenAI details a pipeline that used an upcoming cyber model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2M in API costs (opens openai.com)

OpenAI details a pipeline that used an upcoming cyber model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2M in API costs — Security research that once required a separate, sustained investigation for each finding can increasingly be run as a systematic…

Sentra raises $150M to control what AI agents can reach in corporate data (opens siliconangle.com)

Data security startup Sentra will use the money to expand its platform for controlling what AI agents can reach inside corporate data stores.

Postman silently auto-installs AI plugins and attempts to share all API data (opens github.com)

A GitHub issue reports that opening Postman's desktop app added Postman plugins to Codex and Claude Code, a startup instruction hook and a remote MCP connection without the user's consent.

Gitbook Breached (opens news.ycombinator.com)

A customer posted a support reply about a GitBook breach; they say no official notification had been sent yet.

Show HN: Kairos – Open-source risk and fraud decisioning platform (opens github.com)

Finic's Kairos is an open-source alternative to real-time fraud decisioning platforms such as Sift and Sardine.

OpenAI seems to be silently re-enabling model training on Codex chats (opens news.ycombinator.com)

A poster says the data-sharing setting their team had turned off in Codex was switched back on without anyone opting in.

OpenHack: Always on AI Security Engineer (opens ycombinator.com)

OpenHack finds, verifies, prioritizes and fixes vulnerabilities automatically.

CrowdStrike to acquire cybersecurity startups Fiddler AI, Dreadnode for reported $495M (opens siliconangle.com)

CrowdStrike is buying two startups that secure AI agents, announced alongside an update to its Falcon Guardian product.

Ted Schlein’s Ballistic Ventures seeks $490M for new funds amid AI-driven cybersecurity boom (opens techcrunch.com)

Ballistic Ventures is seeking $360 million for a new flagship fund and $130 million for a separate investment vehicle.

Anthropic releases FlashProve, an open-source prototype that cryptographically verifies an AI response came from a given model, not one that a router swapped in (opens anthropic.com)

The prototype would let anyone check that a response really came from the model it claims to be from.

Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist (opens theverge.com)

Binance's postmortem says the attack began in June when a developer downloaded a tampered installer, and combined fake job interviews with an internal AI tool.

WorkOS reports security breach (opens news.ycombinator.com)

A WorkOS customer posted a breach notification they say they received, for an incident detected on October 30; it was not yet on WorkOS's website or trust center.

North Korea linked to massive Binance crypto heist (opens theverge.com)

The FBI says North Korea was behind the $6.3 billion Binance heist of October 29th; Bloomberg reports Binance ran a global war room of about 100 people to contain it.

Malware uses LLMs to rank victims by how much they're worth (opens blog.talosintelligence.com)