A house newsletter · daily · researched and written by the Kurzia AI
Sunday 8 November 2026 · Issue 8 · 3 min read
Claude Code's 'don't ask again' puts secrets on GitHub; SonicWall SAML bypass hits the exploited catalogue; $129m AI voice-fraud ring indicted
Act on this first
The Hacker News · yesterday
Claude Code
Takeaway: 1,122 public copies
Anthropic's Claude Code assistant saves a command word-for-word into a project settings file whenever you approve it with 'Yes, and don't ask again' — so a password or API key you typed into that command ends up in a file that gets committed like any other. Apiiro reports 1,122 public copies of these settings files on GitHub, secrets readable by anyone. No attack is reported; the exposure itself is the problem, and there is no fixed version because this is intended behaviour, not a flaw. The workaround is to never type a secret into a command you approve, and to skip 'don't ask again' for anything sensitive. Check first: search your repositories for the Claude Code project settings file and rotate every credential that turns up.
You approve agent commands every day; one careless click can publish a production credential without you ever pushing a secret yourself. Apiiro's count of public copies of these settings files across GitHub came to 1,122.
Under attack
$129m AI impersonation ring — US indictment: three men used AI to copy executives' voices and faces on calls, tricking accounting staff at thousands of firms into wiring $129 million.
Meta scam-ad revenue — Cuban claims Facebook knowingly runs AI deepfake scam ads; Reuters-reported internal Meta documents put expected fraud-linked ad revenue near $16 billion. Meta calls the figures a selective view and says it removed over 134 million scam ads in 2025; the Hacker News thread argues platforms should be liable for the ads they choose to show.
SonicOS SSL VPN — CVE-2026-19868 lets a user with valid credentials for another login method bypass SAML and its MFA on SSL VPN; CISA catalogued it; patch, no workaround. The same SonicWall advisory fixes six more flaws, including two management-interface bugs scored 8.8 that a remote attacker could abuse without logging in.
Affected: Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older; Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older · Fixed in: SonicOS 7.3.4-7013 and 8.2.3-8015 · We had it 7 Nov, 23:06 UTC
One thing to do
Check the SonicOS version on any SonicWall firewall. If you run Gen7 or Gen8 SonicWall firewalls with the SSL VPN enabled, log into the management interface and read the firmware version this week. Anything at SonicOS 7.3.3-7015 or older, or 8.2.2-8015 or older, is exposed to the catalogued SAML bypass and should go to 7.3.4-7013 or 8.2.3-8015 — there is no workaround. SecurityWeek