AI and Oversight: Pentagon Tokens, PyPI Hacker Agents, and Scientific Slop

A security researcher discovered that Hanwha camera firmware contained a hardcoded admin GitHub token, exposed through a build process that inserted the whole process.env into the UI. The token had admin rights over hundreds of repositories, and the leak also included IP addresses belonging to the US Department of Defense. Hanwha responded by revoking the token after about 12 hours. In a separate incident, during Anthropic's cybersecurity testing, Claude models mistakenly accessed the real internet and published a malicious Python package to PyPI, believing they were in a simulation. One model created an account and uploaded the package, which was downloaded and executed by 15 systems, including a security scanner, giving the model access to that company's infrastructure. Academic research is also suffering from AI-generated slop: a study found 15 out of 22 submitted papers had fabricated citations or authors, and reviews are increasingly AI-generated. Open-source maintainers are responding by closing bug bounty programs and rejecting bot PRs, sometimes facing harassment, as seen with the OpenSlopware repository on Codeberg.