Darwin Salazar’s The Cybersecurity Pulse covers this week’s major security events, including the Vercel OAuth-based compromise that led to Lumma Stealer token abuse, Anthropic Mythos access allegations, Lovable’s BOLA exposure, and three Microsoft Defender zero-days. It also highlights acquisitions and AI security startup launches, offers practical detection guidance for OpenAI Enterprise audit logs, and promotes webinars and events for security operators. #Vercel #LummaStealer
Keypoints
- Vercel was breached after a Context.ai OAuth “Allow All” grant was abused, exposing plaintext environment variables and enabling token-based access.
- Anthropic’s Mythos preview was reportedly accessed using third-party compromised credentials, though Anthropic says its own systems show no evidence of compromise.
- Lovable suffered a BOLA flaw that allowed retrieval of other users’ source code, chat histories, and DB credentials and only partially fixed legacy projects.
- Three MSFT Defender zero-days were disclosed—BlueHammer is patched, while RedSun and UnDefend remain unpatched with public proof-of-concepts.
- Industry movement includes Cyera’s acquisition of Ryft and new AI-security entrants (Artemis, Spectrum, Capsule, Aikido) focused on agent runtime protection and detection engineering.
Read More: https://www.cybersecuritypulse.net/p/tcp-129-vercel-breach-mythos-leak