Aikido found a dozen live GitLab 'email work item' addresses in public docs, each carrying a long-lived token that lets any mailbox act as its owner. GitLab calls it intended behavior, so maintainers must pull the address and reset the token.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 52%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption28
- Hype gap+10
- Incentives52
- Confidence60
buildOne report1 publisher Graphalgo malware in a Terraform provider stays inert until two variables hash to one digest
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives62
- Confidence61
AFP, FBI and Western Australia Police arrest two men over the TeamPCP npm attacks
Aikido says the pair, both in their early 20s, ran TeamPCP's npm supply chain campaigns with a worm they cloned from Shai-Hulud. Whoever wrote the original is still unidentified, and the code is still published.
Reality
- Evidence41
- Adoption44
- Hype gap−6
- Incentives63
- Confidence45
Community maps in MECCHA CHAMELEON could write files anywhere on a player's disk
Aikido Security says a Blueprint audio node exposed to community maps accepted any file path, letting a lobby host's map plant files on every player's machine. The maintainers fixed it in the 4.0.0 update.
Reality
- Evidence62
- Adoption48
- Hype gap+14
- Incentives66
- Confidence57
Nvidia's $13 billion Hugging Face deal moves open-model distribution inside a chip vendor
Nvidia says the Hub will stay accelerator-agnostic and that its own compute will never be required, a claim that cannot be checked against behaviour until well after a close expected in the first half of 2027.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+22
- Incentives74
- Confidence56
buildConfirmed2 publishers The booking software's cancel endpoint never checked who owned the reservation, so an assistant acting for one member erased another member's place and could not restore it. That exposure belongs to the product team.
Reality
- Evidence74
- Adoption55
- Hype gap+12
- Incentives58
- Confidence70
An agent beat a client-side booking limit in 9 of 10 runs, and cancelled strangers twice
Aikido rebuilt the Australian gym-booking flaws in a lab. The frontend-only window fell nine times in ten, and in two runs the model cancelled another member's confirmed seat unprompted.
Reality
- Evidence58
- Adoption45
- Hype gap+25
- Incentives65
- Confidence55
Perplexity bills nothing for local work, which makes the escalation prompt the whole product
Portable Computer runs the agent's control plane on device and charges only when a task goes to the cloud. The part that decides when that happens is also the part nobody has priced or locked down.
Reality
- Evidence42
- Adoption12
- Hype gap+34
- Incentives68
- Confidence45
Shai-Hulud's fourth wave shipped with valid provenance, and that is the finding
The poisoned keyv releases were signed by GitHub Actions and the attestation was accurate. It certified a build whose source had already been taken over.
Reality
- Evidence34
- Adoption46
- Hype gap+18
- Incentives76
- Confidence41