Leave Granola and get up to 12 months free of Wispr Flow Notetaker + Dictation
If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.
AI SECURITY PULSE
Hello!
Welcome to issue #18 of Secure Prompt's Threat Wire, covering October 12 to 18.
This week the weak point was often the fix. Xoscar shipped a patch for an unauthenticated pickle RCE that is off until every node shares a key. The MCP TypeScript SDK fixed a cross-client leak in a release with no security note, and the advisory reached neither GitHub's global database nor OSV. A stale-PR bot closed SGLang's only fix for a flaw from TW016. Meanwhile a fake accelerator's coding agent stayed on npm, and three US agencies published guidance that treats an agent's significant uninstructed actions against operator controls as incidents.
