On Sept. 17, 2026, Adam Harvey on behalf of the crates.io team and the security response working group warned of an ongoing campaign targeting rust-lang contributors and owners of popular crates. Attackers are arranging seemingly legitimate video calls - for jobs, projects, or contract opportunities - then using those sessions as vectors to get targets to install software (for example, a fake missing audio codec) or to execute commands (for example, by placing malicious commands on the clipboard). The campaign relies on newly created but credible company profiles and plausible LinkedIn presences to survive cursory scrutiny, with the ultimate goal of compromising devices and accounts so they can be used to publish malware.
The recommended response is heightened caution: treat cold outreach with skepticism, prefer calls on platforms you already trust, and whenever possible be the one to initiate the meeting on a familiar service. Audit your accounts now - enable multi-factor authentication, check for unexpected logins or session activity, and verify that recovery and authorizations are intact. For help with crates.io account issues, contact [email protected]; for other security concerns, contact [email protected].
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Eric S. Raymond argues that current AI systems lack agency, persistent goals, and the drive for power, countering doomsday scenarios. He emphasizes that intelligence does not equate to omnipotence or uncontrollable agency, and that human dominance relies more on culture and cooperation than raw cognitive ability. (twitter.com)
US and China security experts have proposed nuclear-style safeguards to manage AI risks, emphasizing the need for international protocols. However, political disagreements and practical challenges make implementation unlikely in the near future. (reuters.com)
Internal documents reveal Microsoft and OpenAI considered news scraping for AI training as an unprecedented theft of labor. They also acknowledged that this practice threatens the future of news publishers and could harm the web ecosystem. (arstechnica.com)
A zero-click remote code execution vulnerability called Plugin4Shell affects the four most popular AI coding agents, including Claude Code, Codex, Copilot, and Gemini. The flaw allows malicious plugins to be silently installed and gain full access to enterprise systems, requiring users to update their agents immediately. (air.security)
AI companies are pushing industry-changing solutions built on questionable ethics, exploitation, and lack of security. The hype and competition among industry leaders have led to risky projects with little regard for societal impact or safety. (netmeister.org)
Missouri governor orders guardrails on Flock cameras and automatic license plate readers to enhance privacy and safety. The move aims to regulate the use of surveillance technology across the state. (stlpr.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.