Publisher
aikido.dev
Newest story built on aikido.dev reporting: Graphalgo malware in a Terraform provider stays inert until two variables hash to one digest (September 23, 2026). aikido.dev reporting informs the Build and Security desks, most often on Agent Harness Design, Agentic AI Security, and AI Accountability and Regulation. 5 of our current stories draw on it, the earliest from August 27, 2026.
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
Aikido says the pair, both in their early 20s, ran TeamPCP's npm supply chain campaigns with a worm they cloned from Shai-Hulud. Whoever wrote the original is still unidentified, and the code is still published.
Reality
Aikido Security says a Blueprint audio node exposed to community maps accepted any file path, letting a lobby host's map plant files on every player's machine. The maintainers fixed it in the 4.0.0 update.
Reality
Aikido spent 11.7 billion tokens rediscovering 32 fresh CVEs with ten models, three attempts each. The number that should move a scanning budget is the marginal cost of the second and third pass.
Reality
The booking software's cancel endpoint never checked who owned the reservation, so an assistant acting for one member erased another member's place and could not restore it. That exposure belongs to the product team.
Reality