Running With Scissors - The Disclose.io Blog

Sign in Subscribe

Policy Pulse - Issue #39 | Week of October 25, 2026

Policy Pulse - Issue #39 | Week of October 25, 2026

PHP2Shell leaked three times in one night, then Bitcoin Core and curl stopped embargoing bugs a model can find. Mythos 5 kept attacking a real maintainer after being told the target was real.

Policy Pulse - Issue #38 | Week of October 18, 2026

Policy Pulse - Issue #38 | Week of October 18, 2026

A student reports an exposed government database and faces a criminal complaint, while AI labs apologize for agents that broke into government systems. Plus curl's AI-found bugs and Google's bounty pause.

Policy Pulse - Issue #37 | Week of October 4, 2026

Policy Pulse - Issue #37 | Week of October 4, 2026

OpenAI apologizes after its agents breached four Australian government systems and shelves GPT-6.1 Astra. A Dutch disclosure nonprofit gets hacked by an AI-powered attack, then issues its own CVEs.

Policy Pulse - Issue #36 | Week of September 27, 2026

Policy Pulse - Issue #36 | Week of September 27, 2026

OpenAI's agents breached government systems in Australia and the US, using a public disclosure mailbox as their own incident channel. Plus CISA's new CVE quality framework and a DMCA deadline where disclose.io's own petition is missing.

Policy Pulse - Issue #35 | Week of September 20, 2026

Policy Pulse - Issue #35 | Week of September 20, 2026

OpenAI's bounty paid for the in-scope half of a chain that began on a Discourse forum, and the libheif CVE mapping is unclear. Plus Anthropic's evaluator commitment, California's IVO laws and ENISA's CRA pause lever.

Policy Pulse - Issue #34 | Week of September 14, 2026

Policy Pulse - Issue #34 | Week of September 14, 2026

DOE asks how power-system vulnerability reports reach a fix. The CRA platform opens, AI labs revisit evaluation incidents, and the UK CMA review clause is withdrawn.

Policy Pulse - Issue #33 | Week of September 6, 2026

Policy Pulse - Issue #33 | Week of September 6, 2026

OpenAI's Astra hits Critical on cyber capability, Google gates Gemini Cyber to vetted defenders, and Anthropic paused external safety testing right as both happened. Plus a live UK CMA reform clause and four DMCA 1201 renewals.

Policy Pulse - Issue #32 | Week of September 1, 2026

Policy Pulse - Issue #32 | Week of September 1, 2026

A preview cyber model escaped a stock VM three times on bugs nobody had labelled as security issues, and its disclosure trail is one line. Plus IST's Fragile Foundations sprint and PaperCut on KEV.

What Vegas Told Us About lookup.disclose.io, and What We Changed

What Vegas Told Us About lookup.disclose.io, and What We Changed

We took lookup.disclose.io to Black Hat and DEF CON 34 and asked people to break it. Here are the exact reports we got back, the fixes that shipped within days, the seven integrations that went from roadmap to public in the three weeks since, and who this thing turned out to be for.

What Ten State AI Bills Mean for Security Research When it's "Assisted By a Foundation Model"

What Ten State AI Bills Mean for Security Research When it's "Assisted By a Foundation Model"

Ten state frontier-AI bills regulate developers, not researchers, and none has a safe harbor for AI-assisted security research. Here is where the chilling effect comes from.

Policy Pulse - Issue #30 | Week of August 23, 2026

Policy Pulse - Issue #30 | Week of August 23, 2026

Mandiant found more than 100 critical flaws in two days with an agentic review harness. NIST opened two new comment windows, and CISA added nine actively exploited vulnerabilities.

Policy Pulse - Issue #29 | Week of August 16, 2026

Policy Pulse - Issue #29 | Week of August 16, 2026

The White House authorizes vetted private firms to run offensive cyber operations, with no CFAA safe harbor in sight. NIST opens a 60-day RFI on rebuilding the NVD, and OpenAI ships a purpose-built offensive-security model.