Chainguard unveiled Harness, which has frontier models such as Claude Mythos 5.1 attack a live build and reports only flaws that reproduce. It arrived with Workspaces and Checks for coding agents and an expansion of Libraries to Go and .NET.
Perspective Coverage
4 publishers
- Builder
- Builder 32%
- Operator
- Operator 44%
- Investor
- Investor 24%
Reality
- Evidence35
- Adoption12
- Hype gap+30
- Incentives70
- Confidence70
Chainguard's Mythos harness finds a vLLM flaw that lets one client dictate another's output
Chainguard says its Mythos harness found a vLLM flaw, left in the public tracker for four months, that lets one client force another client's output. Versions before v0.31.0 are affected, and nothing is logged when the forced answer returns.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap−5
- Incentives65
- Confidence60
GitHub limits private vulnerability reports per day to spare maintainers' review time
GitHub now caps the private vulnerability reports one account can file each day, at thresholds it has not published. Admins can set their own limit and exempt trusted researchers.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence55
buildOne report1 publisher Chainguard's CVE authority will give scanners version ranges for flaws fixed years ago
Chainguard says its Athena coalition will start releasing about 50 findings on September 28, with affected version ranges attached. A scanner needs those ranges before it can flag a pinned old release.
Reality
- Evidence55
- Adoption30
- Hype gap+10
- Incentives75
- Confidence52
LiteLLM 1.82.7 and 1.82.8 shipped an infostealer: rotate everything those machines touched
GitGuardian says the TeamPCP campaign poisoned two LiteLLM releases on PyPI to harvest SSH keys, cloud credentials and API tokens. Detection is the cheap part of this job.
Publishers:blog.gitguardian.com
Reality
- Evidence52
- Adoption27
- Hype gap+24
- Incentives78
- Confidence46