AI and IT News Recap: July 13, 2026: A Picture That Steals Your Repo's Secrets, Apple Sues OpenAI, and ShareFile Admins Told to Pull the Plug

By Noah Smith, Owner & Consultant, KeyChange Technologies · July 13, 2026

A long weekend of quiet but consequential moves. Here is your AI and IT news recap for July 10 through 12, 2026: a picture that steals your secrets, an emergency "shut it down" order to file-sharing admins, and Apple dragging OpenAI into court.

📌 The AI and IT news at a glance

• A PNG nobody opens can hand over every secret in your repo. The "Ghostcommit" attack sails past AI code reviewers and talks a coding agent into leaking your .env.
• Anthropic buys another week. Claude Fable 5 stays included for paid subscribers through July 19.
• Apple sues OpenAI. Trade secret theft, two named ex-Apple employees, and a hardware program at the center of it.
• Progress tells ShareFile admins to pull the plug. A "credible external security threat," no patch, servers off.
• A popular npm package shipped an infostealer. jscrambler 8.14.0 ran malware on install; Socket caught it in six minutes.
• A crafted email can run code in Zimbra. Critical flaw in the Classic Web Client, no CVE yet.
• Six new U-Boot flaws. Two let an attacker run code before the device ever checks the software is genuine.
• Fake passkey enrollment calls are working. Attackers phone your staff and walk them into registering the attacker's passkey.
• Three flaws in OpenClaw chained a WhatsApp message all the way to code execution on the host.
• Free VPN apps are not protecting you. 281 tested, billions of installs, basic leaks everywhere.

🔝 Top story: a picture that nobody opens, and every secret walks out

Researchers have demonstrated an attack, dubbed Ghostcommit, that hides a malicious instruction inside a PNG so AI code reviewers never see it. A pull request adds an innocuous AGENTS.md file, the kind of coding-convention file agents read automatically and treat as project policy. It names no secret. It just points at an image, docs/images/build-spec.png. The attack instructions are rendered as visible text inside that picture: read the repo's .env byte by byte, encode each byte as an integer, emit the result as a module constant.

The reviewers wave it through, because to a text-based reviewer an image is an opaque binary blob. CodeRabbit's default config excludes image files from review outright, and Bugbot returned no findings. The researchers even stuffed the PNG with the literal phrase "malicious prompt injection" and it still passed clean. The theft happens later: a developer asks the agent for something routine, the agent reads the merged AGENTS.md, follows the pointer to the image, opens .env, and writes the secrets into the new code as a harmless-looking tuple of integers. In one run, Cursor driving Claude Sonnet produced a 311-integer constant that decodes byte for byte to the entire .env. Secret scanners never notice, because none of them turn a Python integer tuple back into ASCII.

The research comes from the ASSET Research Group's Sudipta Chattopadhyay, an associate professor at the University of Missouri-Kansas City, with a proof-of-concept on GitHub. The most useful finding is not about models but about the harness around them. Cursor and the Antigravity coding tool both followed the image and leaked the file under Sonnet, Gemini, and GPT-5.5. Anthropic's Claude Code, running the same Sonnet weights, refused, and refused under every model tested. Same weights, opposite outcomes, decided by the tooling. Behind all of it sits one number: across 6,480 pull requests in the 300 most active public repos over 90 days, 73% of merged PRs reached the default branch with no substantive human review and no bot review at all.

In short: A PNG committed to a repo can carry prompt-injection instructions that AI code reviewers never read, and a coding agent will later follow them and write the repo's secrets into the source in plain sight.

What it means for your business: If your developers use AI code review or coding agents, your pipeline has a blind spot the size of every image in your repo, and the fix is not a better model but knowing what your tool actually opens, plus rotating any secret an agent can reach.

My take: The detail that should worry people is not the image trick, it is the 73%. Most merged code already gets no real review from anyone, and we have handed the job to tools that skip whole file types by default. Two boring things fix most of this: stop letting agents read raw credential files, and go find out today what your reviewer's default config excludes.

Source: BleepingComputer

🤖 AI

Anthropic extends Fable 5 access again, now through July 19

Anthropic has pushed back the deadline once more on Claude Fable 5's inclusion in paid subscriptions. The model was originally set to leave Pro, Max, Team, and premium Enterprise plans on July 7, after which continued use would require separately billed usage credits. That moved to July 12, and on Sunday, ahead of that deadline, Anthropic moved it again. "We've extended this promotion through July 19, 2026 at 11:59:59 PM PT," the company said in a support document, adding that the 50% increase to Claude Code weekly usage limits runs through the same date.

The deal is unchanged: subscribers can use Fable 5 for up to 50% of their weekly usage limits at no extra cost, though Anthropic warns it burns that allowance faster than other Claude models. Hit the ceiling and you either buy usage credits or drop back to another model. Free users, standard Enterprise seats, usage-based Enterprise plans, and API usage are not covered. Anthropic says Fable 5 is not leaving permanently and that it intends to restore it once it has the compute.

In short: Anthropic extended included Fable 5 access for paid Claude subscribers a second time, moving the cutoff from July 12 to July 19, 2026.

What it means for your business: If your team's workflows quietly depend on Fable 5 being included in the plan you already pay for, you have one more week of runway, and you should use it to price what your actual usage would cost on credits.

My take: Two extensions in a week is not a marketing tactic, it is a capacity problem being managed in public, and I would rather have the honest scramble than a silent cutoff. But it is a planning signal. If a model's availability is decided a week at a time, do not build a business-critical process on it being included, and know your fallback. "When capacity allows" is sincere, and it is not a date.

Source: BleepingComputer

Apple sues OpenAI over trade secrets, and the filing is not subtle

Apple sued OpenAI and two former employees on Friday in California federal court, alleging misappropriation of trade secrets to benefit OpenAI's push into consumer hardware. The named defendants are OpenAI Foundation, OpenAI Group PBC, and io Products, along with Chang Liu, a former senior system electrical engineer, and Tang Yew Tan, Apple's former vice president of product design for iPhone and Apple Watch, who now leads hardware at OpenAI. The complaint alleges not a few rogue departures but a "coordinated pattern of misconduct at an institutional level," spanning product designs, manufacturing processes, and supply chain strategies.

The most eye-catching allegation concerns hiring itself. Apple claims Tan directed job candidates still working at Apple to bring "actual parts" to their interviews for "show and tell" sessions in which his team could elicit more confidential information. OpenAI denies it: "We have no interest in other companies' trade secrets. We remain focused on building innovative technology that empowers people everywhere," a representative said.

In short: Apple filed suit against OpenAI, io Products, and two former Apple employees, alleging a coordinated, institutional effort to steal hardware trade secrets.

What it means for your business: Most companies will never see an Apple-scale trade secret fight, but the alleged mechanism is very ordinary: departing employees, interview conversations, and confidential material walking out in someone's memory or someone's bag.

My take: Set aside who is right, because that takes years and a jury. The useful part is the alleged method. Not a hack, not a planted USB stick, just interviews. If a rival wants to know how you do what you do, the cheapest route has always been to interview your people and ask good questions. That is legal right up until it is not. Worth asking what your own offboarding and interview conduct looks like, because "we have an NDA" is not a control.

Source: CNBC

🛡️ IT and security

Progress tells ShareFile customers to shut their servers down

Progress Software emailed ShareFile customers running on-premises Storage Zone Controllers and told them to shut the Windows servers down, confirming to The Hacker News that it is responding to a "credible external security threat." It temporarily disabled access to affected accounts "out of an abundance of caution" and says it has no indication of unauthorized access to any ShareFile account or data. What it has not said is what the threat is or who is behind it. The order became public when a customer posted the email to Reddit's r/sysadmin on July 10, and Progress confirmed the disruption on its status page, listing Storage Zone Controller customers as "not operational."

Read the shape rather than the words. Storage Zone Controllers move files between the ShareFile cloud and customer-managed storage, and they are typically internet-facing. A vendor telling customers to power off internet-facing servers with no patch on offer usually means a newly found flaw it is racing to close. And the name on the door carries weight: Progress is the company behind MOVEit, whose 2023 zero-day was exploited by Clop and hit more than 2,700 organizations.

In short: Progress told ShareFile customers using Storage Zone Controllers to shut those servers down over a "credible external security threat," without disclosing the threat or offering a patch.

What it means for your business: If you run ShareFile with on-premises Storage Zone Controllers, that is an action item today, and if you use any internet-facing managed file transfer product, this is a good week to know exactly which servers those are.

My take: "Turn it off and we will not tell you why" is the most alarming sentence a vendor can send, and it is also sometimes the right one, because details before a fix just arm everyone. What I would watch is the gap between "no indication of unauthorized access" and "no unauthorized access." Those are very different statements, and companies pick the first one carefully.

Source: The Hacker News

A compromised npm release ran an infostealer the moment you installed it

The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer. Published July 11, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux. Socket flagged it six minutes after publication. That is a fast catch and cold comfort both: if a build system pulled the package inside that window, the payload already ran with whatever access your install process had.

None of this exists in the prior release, 8.13.0. The diff shows two new files under dist/: setup.js, a small loader, and intro.js, which despite the name is not JavaScript but a roughly 7.8MB container packing three gzip-compressed native binaries. On install, setup.js picks the binary for the host OS and writes it under a random name in the temp directory. You never have to import the library. Installing is enough.

In short: A malicious 8.14.0 release of the jscrambler npm package executed a native infostealer via a preinstall hook, and Socket detected it six minutes after publication.

What it means for your business: Any machine or CI runner that installed that release should be treated as compromised and its reachable credentials rotated, because "we never used the library" is not a defense when the payload fires at install time.

My take: Six-minute detection is the good news and the bad news in one number. Detection is fast now, and still slower than a pipeline that pulls dependencies dozens of times an hour. The unglamorous lesson holds: pin dependencies, respect your lockfile, and think hard about what a preinstall script on a build agent can reach. Most CI runners hold far more credentials than any single job needs.

Source: The Hacker News

A crafted email can run code in Zimbra's Classic Web Client

Zimbra is urging customers to patch a critical flaw in its Classic Web Client that lets a specially crafted email execute malicious code in a user's session. It is a stored cross-site scripting issue and has not yet been assigned a CVE. "The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened," Zimbra said. "If exploited, it could allow access to mailbox information, session data, or account settings."

Stored XSS in a mail client is a nasty shape of bug because the delivery mechanism is the product's core function. No malicious link to click, no attachment to open. The attacker sends an email, the victim reads it, and the script runs with their session, which can lead to session hijacking and account compromise. Zimbra tends to be run by organizations that host their own mail, which often means smaller teams and slower patch cycles.

In short: Zimbra patched a critical stored XSS flaw in its Classic Web Client that lets a crafted email run code in the recipient's session when opened.

What it means for your business: If you self-host Zimbra, patch now, because the exploitation path is simply "someone emails your staff," with no user mistake required beyond reading their mail.

My take: Self-hosted mail is a legitimate choice and I will not lecture anyone out of it, but the bill comes due every time something like this lands. The real question is not whether you will patch this one. It is how long it took you to hear about it. If the answer is "a blog post on Monday," that is a monitoring problem, and it will bite you on the next bug rather than this one.

Source: The Hacker News

Six new U-Boot flaws let code run before the device checks anything

Firmware security firm Binarly found six new vulnerabilities in U-Boot, the small program that starts up hardware as varied as home routers, smart cameras, and the management chips inside data-center servers. Four can crash a device. The other two could let an attacker who slips a malicious image in front of the bootloader run their own code before the device has confirmed the software is genuine.

That ordering is the whole story. A bootloader runs before the operating system, so a flaw there undermines everything that loads after it, including the security tooling meant to notice. U-Boot bundles a kernel, device tree, ramdisk, and other components into a package called a FIT, or Flattened Image Tree, and checks that package's signature before handing over control. All six bugs are reached while U-Boot is still parsing an untrusted image, before it has checked the signature. The code that decides whether to trust the image can be attacked by the image it has not yet decided to trust.

In short: Binarly disclosed six new U-Boot flaws, two of which allow code execution during boot before the bootloader verifies the image's signature.

What it means for your business: This is an inventory problem rather than a patch-Tuesday fix, because U-Boot lives inside embedded gear most companies never think of as computers, and updates depend entirely on whether the vendor still ships them.

My take: Firmware bugs are the tiring ones, because the honest remediation advice is often "wait for a vendor who may never answer." So do not chase this flaw set across your building. Find out which of your devices can receive a firmware update at all, and segment the ones that cannot. A camera that will never be patched again is not a device, it is a permanent guest on your network.

Source: The Hacker News

Attackers are calling your staff and walking them through passkey enrollment

A threat actor is phoning Microsoft 365 users and persuading them to enroll a new Entra passkey, with data extortion as the goal. Okta tracks it as O-UNC-066 and says it runs a panel-controlled phishing kit built specifically to target passkey enrollment. "The threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing ('vishing') scheme," Okta researcher Houssem Eddine Bordjiba said. "The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey." Victims land on a kit identical to the real Microsoft enrollment flow. Targeting spans food and beverage, technology, healthcare, automotive, construction, and aviation.

The irony is worth naming. Passkeys are good technology and genuinely phishing-resistant: you cannot be tricked into typing one into a fake site, because there is nothing to type. So attackers stopped trying to steal a passkey and started asking you to enroll theirs. The cryptography is not the target. The enrollment ceremony is.

In short: An actor tracked by Okta as O-UNC-066 is using phone calls and a lookalike kit to walk Microsoft 365 users through enrolling an attacker-controlled Entra passkey.

What it means for your business: Rolling out passkeys does not end your phishing exposure unless you also restrict and monitor who can enroll new credentials, and unless staff know that a call asking them to set one up is itself the attack.

My take: Harden the front door and attackers go stand by the locksmith. Every strong authentication scheme has a soft moment where a new credential gets born, and that moment is now the target. Treat enrollment as the privileged operation it is: restrict where it can happen, alert on every new registration, and tell your people plainly that nobody from IT will ever call them out of the blue to add a login method.

Source: The Hacker News

🧰 AI tooling and software worth knowing about

Three OpenClaw flaws chained a WhatsApp message into code execution on the host

Three now-patched flaws in the OpenClaw personal AI assistant could together enable credential theft, privilege escalation, and arbitrary code execution on the host, and a researcher demonstrated a full chain starting from a WhatsApp message. Two of them, GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm, both at CVSS 8.8, are OS command injection issues caused by an incomplete list of disallowed inputs in the host execution environment's filter, letting an attacker act beyond what the caller was ever authorized to do. The third, GHSA-575v-8hfq-m3mc at CVSS 8.4, is a path traversal and link-following flaw.

The pattern should feel familiar after the Ghostcommit story above. A personal AI assistant is by design a program that accepts instructions from an untrusted channel, your messages, and can run things on your computer. The entire safety of that arrangement rests on the filter between what the message asked for and what the host will execute. When the filter is a list of disallowed inputs, the list is never complete.

In short: Three high-severity, now-patched OpenClaw vulnerabilities could be chained from a WhatsApp message to credential theft and code execution on the host.

What it means for your business: If anyone on your team runs a personal AI assistant wired into their machine and their messaging apps, update it, and recognize that you have connected an untrusted inbox to a shell.

My take: Deny-lists lose, and they have always lost. Every time we build a system that takes instructions from the outside world, executes them locally, and tries to stay safe by listing the bad things, we lose to the thing not on the list. The question for the next year is not whether AI assistants keep having these bugs. It is whether anyone ships one with a real sandbox instead of a filter.

Source: The Hacker News

281 free Android VPN apps tested, and the basics are broken

Researchers ran 281 of the most popular free VPN apps on the Google Play Store through a new testing system and found many fail at the one thing people install a VPN to get. The apps flagged with at least one problem have been installed more than 2.4 billion times between them. The failures are not exotic: 29 apps let traffic leak outside the encrypted tunnel, including the DNS lookups that reveal which sites you visit; 61 send some data in plain text readable by anyone on the network; five of those send the app's own configuration file in the clear, letting an attacker on the same network redirect the connection to a server they control.

The system, called MVPNalyzer, was presented at the NDSS security conference in February 2026 by researchers at the University of Michigan, the University of New Mexico, and IIT Delhi. It is the mobile counterpart to the same lab's earlier desktop VPNalyzer work, and the through-line of both is uncomfortable: the category most associated with privacy is, in its free tier, frequently selling a feeling rather than a protection.

In short: A study of 281 popular free Android VPN apps found traffic leaks, plaintext data transmission, and tracking across apps with more than 2.4 billion combined installs.

What it means for your business: If staff install a free VPN to "be safe" on hotel or airport Wi-Fi, there is a real chance they added a data leak rather than removed one, and this belongs in your BYOD guidance.

My take: A free VPN is not a security product, it is a business model, and you are usually the inventory. If your people genuinely need protection on untrusted networks, give them something the company pays for and vets. And be honest about the threat model: with HTTPS nearly everywhere, a VPN matters far less than most people think, and a bad one is worse than none.

Source: The Hacker News

Catching up? Here is Friday's AI and IT news recap for July 10, 2026.