Infrastructure Security Privacy

AI Expands Its Reach While a Single HTTP Header Threatens Millions of Agents

Anthropic moved its Claude Code self-hosted sandbox and security plugin into public beta, allowing enterprises to run AI agent code on their own infrastructure rather than Anthropic's cloud. The release addresses a core corporate concern about data sovereignty, letting companies capture AI capabilities without routing proprietary information through external servers.

That advance arrived alongside a stark warning: security researchers disclosed a critical vulnerability dubbed 'BadHost' in Starlette, a framework underpinning millions of AI agents worldwide. Attackers can reportedly bypass authentication using a single crafted HTTP header, an exceptionally low barrier that threatens every application built atop the affected infrastructure.

A separate threat actor identified by Wiz researchers as JINX-0164 has been targeting cryptocurrency firms through fake LinkedIn recruiter messages and custom macOS malware designed to infiltrate development pipelines — an approach that could allow attackers to modify code before deployment and compromise entire platforms.

On the research front, a study published in Nature found that a redesigned 'diversified extremity' feed tested on Bluesky reduced users' exposure to polarizing content without lowering satisfaction, challenging the assumption that engagement requires controversy. Separately, privacy technology firm Ketch launched an AI agent network for enterprise compliance, reflecting the growing complexity of meeting data protection regulations across multiple jurisdictions.

The American Federation of Teachers called for AI bans in elementary schools and screens off through second grade, bringing organized labor formally into the debate over technology's role in early childhood education. Anthropic also announced appointments of its first Korea chief and an India sales lead, signaling an intensifying geographic competition for AI deployment.