Wallets
The Approval Code Went to an Inbox the Agent Could Read. Nine of Ten AI Models Used It.
Key takeaways A Cornell Tech, Yale and IC3 preprint gave ten AI models a Circle Agent Wallet with 10 USDC, a 0.01 USD…
Security
A Fix Can Exist and Still Not Be Yours. BTCPay's Sat Merged but Unreleased for Seven Days.
Key takeaways BTCPay Server merged PR #7684, 'Enforce API key permission scope', on 19 October 2026 - but the…
Risk
Two Tokens, Both Backed One-for-One by Nvidia Shares, Trading at Different Prices. That Gap Is the Whole Lesson.
Key takeaways Backed's NVDAx and Ondo's NVDAON are each backed one-for-one by Nvidia shares, yet their prices…
Regulation
Carrying the Order Is Technical. Choosing Where It Goes Is a Judgement. The UK Just Drew That Line.
Key takeaways The UK created a new exclusion from the arranging-deals activity for firms that merely provide a techni…
Technology
Keeping a Bug Secret Only Works If Nobody Else Can Find It. Bitcoin Core Just Conceded That Changed.
Key takeaways Bitcoin Core revised its vulnerability disclosure policy on 23 October 2026, adding a triage label for …
Wallets
Mozilla Removed the Extensions. For Anyone Who Typed a Seed Phrase, That Changes Nothing.
Key takeaways Socket identified 16 malicious Firefox extensions cloning Rabby and OKX wallet interfaces: four repacka…