Topic
security
12 stories about security—and the choices behind the technology we make.
← Back to all storiesGot a text about an unpaid toll? Someone was watching you open it
Microsoft, Japan's National Police Agency and Health-ISAC have taken down YAM Store, CoGUI and Iron Man, the services behind more than a billion toll, parcel and bank lure messages this year. How the kits work, why a scammer is watching each victim live, what to do if you already tapped, and where a password manager helps and where it can't.
Copilot will act on your PC "with your permission". Who gets to click Allow on your passwords?
Microsoft says Copilot will read your files and take actions across Windows, with your permission, and that agents will run in containers. Neither post says a word about passwords or sign-in. What an agent on your own PC can reach, and how to make sure a click isn't enough to get your logins.
That Google sign-in window says accounts.
Unnamed scammers are passing off fake AI ad tools as ChatGPT, Gemini, Claude and Meta Muse products. Their "Connect" button opens a Google sign-in window that's really just part of the web page, address bar included. How the browser-in-the-browser trick works, how to spot it, and why Vauz, which fills by the real address, won't hand it your Google password.
Giving OpenAI's dots your passwords? Ask who's typing them, not who's reading them.
OpenAI's dots are always-on agents with their own cloud computers, and they can sign in to websites with your saved passwords. Keeping a password from the model is a real protection. It just isn't the same as keeping it on your side, and that difference decides which logins you should hand over.
The OpenAI agent that got into Medicare, and what it means for your passwords
An OpenAI agent got past the blocks on an Australian Medicare portal because it wanted an answer. Here's why a "no" enforced by software an agent can reach isn't a no, and where the check on your passwords should sit instead.
What a leaky Twitch extension says about your other extensions
A Twitch extension read your login token and sent it to a russian bot service's proxy servers, where it sat in cleartext in the logs. It stopped only after researchers made it public.
What it means to let an agent hold your passwords
iOS 27 ships this month with a Passwords app that signs into your accounts and fixes weak or reused passwords on its own. That's a genuinely new kind of permission to grant a piece of software — and a good moment to ask what should be true before any tool, agentic or not, gets to act on a stored credential.
Infostealers took 1.
Infostealers took 1.7 billion credentials from 7.4 million machines in six months. No password manager stops malware already running as you — but where your vault lives decides how much one infection is worth, and whether someone else's bad year can add to it.
What a forgotten master password costs you, and who pays for it
CVE-2026-75135 let a local attacker recover a password manager's master password from memory. The bug wasn't sloppy code — it was the price of promising to help you when you forget.
What “zero-knowledge encryption” actually promises
Zero-knowledge encryption is a promise about one opponent: the company holding your vault. Four cryptographers spent a year testing whether four password managers were keeping it.
The Vauz signing key: check your download is genuine
Every Vauz release is signed with the same minisign key. Here it is, with the three commands that check a download — and why one copy of a key proves nothing.
Clickjacking steals passwords. Here's how Vauz stops it.
Researchers showed that one invisible click can drain a password manager's autofill. Vauz 1.4.2 answers with an approval prompt the page cannot draw over — Touch ID, or your V-Key.