Attackers are logging into people’s Claude and ChatGPT accounts and running up their usage — without ever knowing the password or touching two-factor auth. The trick is stealing your already-logged-in session, and it works on almost any AI service. Here’s exactly how it happens and the handful of habits that shut it down.
Ask an AI coding assistant for the right library and sometimes it confidently names one that doesn’t exist. Attackers noticed. They’re registering those hallucinated package names and waiting for you to run install. It’s called slopsquatting, it’s disturbingly predictable, and here’s exactly how to keep it out of your projects.
A single click or a line of invisible text can quietly tell your AI assistant to work for someone else. Here is what prompt injection is, why the Microsoft Copilot ‘Reprompt’ flaw was a wake-up call, and the practical habits that keep you safe.
Researchers just showed that a booby-trapped code repo can trick six popular AI coding assistants into writing files where they shouldn’t – and that the ‘approve this action’ button you rely on can be lying to you. Here’s what the GhostApproval flaw means, why blind trust in AI code is the real risk, and the simple habits that keep you safe.
