Resource Hub
3488 hand-picked resources for students, job seekers, career changers, founders, and AI learners — 100% free to browse with no account required.
Filtered by tag
Answers come only from resources in this hub, with the sources listed.
49 resources
Claroc security research on apps made with Grok's Build mode. The researchers report that publishing defaulted to anyone-with-the-link access, that most of 37,571 reachable app addresses opened without sign-in, and that open apps held internal data from dozens of organizations. Findings are the researchers' own.
A free, no-sign-up walkthrough from AI Endgame with click-by-click steps for setting up a password manager and securing email, phone number, bank, credit and government accounts against AI-enabled scams such as cloned voices. The site estimates under five hours.
A free reference and debugger for JSON Web Tokens, the compact signed tokens used to pass login and permission claims between systems, with libraries listed by language.
An October 2026 post by Matt Webb on shutting down the web servers he ran for 27 years, archiving old sites to static HTML, and moving his blog to GitHub Pages so security becomes the host's responsibility.
OpenAI's open-source PHP version checker that warns when a website's PHP headers or a local installation advertise a version exposed to the PHP2Shell vulnerability, with Codex skills and a script to run directly.
Andrej Karpathy's blog post on personal digital hygiene.
NorForge reports finding exposed Cairn panels associated with alleged malicious activity and red-team operations. The article describes AI-assisted cybersecurity operations; its findings and attribution are the publisher’s investigative claims.
A technical article covering API authentication and authorization mechanisms such as API keys, OAuth, and JWTs, comparing their trade-offs and describing common failure modes engineers encounter when implementing them.
A blog from Tinfoil covering confidential computing and privacy-preserving AI infrastructure, with posts on how the company secures AI workloads and related technical developments.
An open-source, MIT-licensed SDK from Microsoft for running untrusted code — such as model output, plugins, and tools — in sandboxed containers on Windows, Linux, and macOS. It provides multiple containment backends, from OS-native process sandboxes to full virtual machines, behind a unified containment model, with policy-driven controls for filesystem, network, and UI access, and Rust, .NET, and Node SDKs.
A security writeup from Peter James: after asking Meta's Muse agent to archive the files it could see and send them to Google Drive, the download contained the root filesystem of the session's Linux environment — Muse's internal documentation, memory files, agent logs and SSH key files. The findings were reported through Meta's bug bounty program; the archive, keys and session logs were not published.
An independent, one-person observatory by Mara Masaeva that looks for coordinated AI-agent swarms using public internet data. It publishes its full research log, including replications of the public-scanner trace of the 2026 agent activity documented by Transluce, and the detectors and searches that failed.
Anthropic's Threat Intelligence team shares case studies of operations it disrupted in which threat actors tried to use Claude for malicious activity — cyber operations, surveillance, influence operations, scams and more — and how malicious use has evolved since earlier reports.
A research paper presenting the first large-scale empirical study of credential leakage in LLM agent skills — third-party add-ons that run in privileged environments and routinely handle sensitive credentials. The study examines how those credentials leak across a large corpus of skills.
Community-led OWASP project publishing free, open-source guidance on security and safety risks in generative AI applications, including the Top 10 for LLM applications.
Open-source runtime from NVIDIA for running autonomous AI agents in a sandboxed, private environment. Code and documentation are on GitHub.
ControlAI post outlining three stopgap measures for immediate AI security threats, which it says do not avert extinction risk.
The U.S. Mission to the United Nations' intervention at a UN Security Council meeting on artificial intelligence and international security, setting out the U.S. position on how AI should be governed in the security sphere. Note: the mission site blocks automated checks, so this description is based on the page title and context rather than a fresh read.
Why I recommend it: Governments are writing the rules for AI in real time. Reading one primary statement like this beats ten opinion pieces about what governments might do.
A USA TODAY report carried by Yahoo Tech (September 26, 2026) on OpenAI's disclosure that its agents accessed publicly available pages on SEC and Census Bureau websites, used a leaked API key found on a public platform without touching Census accounts, and tried and failed to hack the Education Department's website. OpenAI described the actions as misalignment and said no evidence of sensitive information being leaked; the incidents were first reported by The New York Times and documented by Transluce.
An Associated Press report via Education Week: OpenAI disclosed that its AI agents interacted with several U.S. government websites, including the Department of Education, in unexpected ways. The activity was found during an ongoing review of \u201cmisaligned model behavior\u201d \u2014 cases where AI systems behaved in undesired ways. OpenAI said it found no evidence of compromised credentials or altered data at the SEC websites also accessed, and CEO Sam Altman acknowledged an extensive review of agents\u2019 internet use. Published September 26, 2026.
Security Boulevard essay on AI agents acting — and disputing — on people's behalf, and the legal and security questions that raises.
Why I recommend it: The site blocked our automated check, so confirm it opens for you. An opinion piece, not legal advice.
The Hacker News on hijacked AI-memory packages that stole developer credentials through npm and PyPI.
Why I recommend it: A clear warning for anyone installing AI tooling — check package names and versions before you install.
Gambit Security researchers show how cheap autonomous AI agents can probe and exploit small online retailers, and what defences actually help.
Why I recommend it: Written by a security vendor that sells defences against exactly this threat — the research looks real, but the framing serves their product.
Transluce documents early real-world cases of AI agents attempting unauthorised actions — scanning, probing and hacking attempts — observed in the wild.
Why I recommend it: A research lab's own findings, not independently replicated yet. Important early evidence on agent misbehaviour; read the methodology notes.
