NewsThe Register — Security
Agents reveal secrets when offered to team up with each other
Teaser from the source
If you wouldn't put it on GitHub, don't give models access to it
This is the RSS-feed teaser. Read the full article at the original source.
Read at The Register — SecurityMore on secrets
Other advisories
- Highpwn_watch:claude-code-settings-local-json-secrets-exposure-nov-2026Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets
- Not ratedosv:CLEANSTART-2024-UP63455design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs)
- Not ratedosv:CLEANSTART-2026-YW36992Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers
- Not ratedosv:CLEANSTART-2026-IX31999OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys
- Not ratedosv:CLEANSTART-2026-UA46955security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containe...
- Not ratedosv:CLEANSTART-2026-TO39207Security fix for GHSA-gcjh-h69q-9w9g applied in: external-secrets-operator 2.8.0-r1, rancher-agent 2.11.15-r1, yunikorn-k8shim-fips 1.8.0-r2
- Not ratedosv:CLEANSTART-2026-SG72830Security fix for GHSA-mh2q-q3fh-2475 applied in: bank-vaults 1.32.1-r1, minio 0.20250907.161309-r3, rclone 1.72.1-5, rclone 1.73.5-r0, haproxy-ingress 0.15.4-r0, openbao 2.5.4-r1, argo-cd-fips 3.3.7-r0, cortex 1.21.1-r2, cortex 1.21.1-r3, external-secrets-operator-fips 2.4.1-r0, thanos 0.41.0-r0, fulcio 1.8.7-r2, prometheus 3.10.0-r1
- Not ratedosv:CLEANSTART-2026-VG29890Security fix for GHSA-gcjh-h69q-9w9g applied in: cert-manager 1.18.6-r4, kube-state-metrics 2.20.0-r0, kyverno 1.18.2-r1, rabbitmq-cluster-operator 2.20.1-r5, rabbitmq-cluster-operator 2.21.1-r2, kedacore-http-add-on 0.15.0-r0, kubernetes-csi-external-resizer 2.0.0-r2, kedacore-http-add-on 0.13.0-r0, kyverno 1.17.2-r2, yunikorn-k8shim 1.8.0-r1, rabbitmq-messaging-topology-operator 1.19.3-r2, tekton-chains 0.29.7-r1, kube-state-metrics 2.18.0-r7, kube-state-metrics 2.19.1-r1, external-secrets-operator-fips 2.7.0-r1, eks-distro-kube-scheduler 1.36.9-r1, kube-rbac-proxy-fips 0.22.0-r1, cluster-autoscaler 1.35.2-r1, cluster-autoscaler 1.36.1-r1, cluster-autoscaler 1.36.1-r6, cluster-autoscaler 1.36.1-r7, kubernetes 1.33.13-r0, openbao 2.6.3-r1, helm-operator 1.39.2-r1, helm-operator 1.42.3-r2, helm-operator 1.40.0-r1, calico 3.30.7-r6, fluent-operator 3.10.0-r0, metallb 0.16.0-r2, calico 3.32.1-r1, kube-state-metrics 2.16.0-r9, grafana-org-operator 1.13.0-r0
Other news entries
- Threat actors use agentic AI tooling to find and abuse exposed secretsNewsMicrosoft Threat Intelligence
- Nearly 1.5 million exposed secrets targeted in new revocation programNewsBleepingComputer
- GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secretsBreachpwn.watch
- Northflank security breach leads to abuse of customers' AI API keysNewsBleepingComputer
- Northflank security incident: PaaS tells users to assume all environment variables were decryptedBreachpwn.watch
- Imposter abused trust in OpenAI, Anthropic, and 30 others to hunt for secretsNewsCSO Online
- Gheist turns GitHub Actions into a secret extraction serviceNewsCSO Online
- Secrets Management Firm Infisical Valued at $600 Million After $40 Million RaiseNewsSecurityWeek
ID