vibehacker
News
GitHub (coleam00/Archon) ·

Archon v0.12.1 stops release binaries from leaking a target repo's .env keys to Claude and Codex

In v0.12.0 (Oct 17), a provider plugin started inside a repository loaded that repo's .env, so a project's ANTHROPIC_API_KEY could reach Claude and override your subscription; v0.12.1 no longer reads .env or bunfig.toml from the working directory, and if you ran v0.12.0 you should upgrade and rerun archon provider add for each provider. Neither release's notes mention a fix for the unauthenticated control API flaw, CVE-2026-111322.

Read at github.com

More news

View all

Astrocade's hosted MCP lets Claude Code, Codex, and Cursor build and publish games to its feed

Adding https://mcp.astrocade.com/mcp (for Claude Code: claude mcp add transport http scope user astrocade https://mcp.astrocade.com/mcp ) lets an agent create, edit, and publish games through your Astrocade account, including ones you started in its app. Games published this way pass review before reaching the Astrocade feed, then get the same plays, comments, and analytics as any other game…

Astrocade Blog

OpenCode says a Console breach may have exposed provider API keys for 1.4% of Console users

OpenCode told affected users someone got into a legacy Console system it was decommissioning, and that OpenAI, Anthropic, and other provider keys saved in their workspaces may have been exposed; it tied the Oct 17 breach to a "large scale distillation attack" and says only users with linked external providers who got its email were hit. If you got that email, revoke and reissue those keys in each provider's dashboard and check recent usage, since some users report charges they didn't make…

The Latent

Spotted something we missed? Start a thread.