2026-11-10 AI 与数据工作流雷达
来源：The Hacker News。这里只保留与 AI 编程、数据/研究工作流、安全边界或可信工程直接相关的高信号线索；不抓取全文，也不代表事实核验或产品推荐。
Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
主题：AI 编程与开发工具 / 数据工作流与自动化
来源日期：2026-11-07
相关性分数：9
候选状态：待评估
为什么值得看：命中与临床统计、研究工程或可信 AI 工作流直接相关的高信号主题；仍需阅读全文并回到官方文档、原始研究或供应商公告交叉核验。
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects “ Yes, and don’t ask again ,” Anthropic’s AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public copies of that file hold at least one secret, though it did not test whether any still work. One company the researchers notified earlier this week confirmed its key had been live. The file is .claude/settings.local.json. Removing it from a project does not undo the leak, because older versions stay in git history and in forks of the repository. The researchers’ advice is to rotate first: change every password, token, and key the file has ever held, then clean up. How a Secret Lands in the File By default, Claude Code asks before it runs most shell commands. If the u…
可转化方向：评估是否能转化为临床编程、代码审查、测试或自动化实践；评估对可复现分析、依赖管理、数据质量或研究工程流程的启发
AI Security Training for the Job You Already Have
主题：AI 与数据安全
来源日期：未提供
相关性分数：3
候选状态：待评估
为什么值得看：命中与临床统计、研究工程或可信 AI 工作流直接相关的高信号主题；仍需阅读全文并回到官方文档、原始研究或供应商公告交叉核验。
SOC, DFIR, pentest, app security: see the six GIAC AI certifications and the labs behind each.
可转化方向：评估 AI 辅助研究和编程中的隐私、凭据、供应链与安全边界
Anthropic’s Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark
主题：AI 工程与可信性
来源日期：2026-11-10
相关性分数：2
候选状态：待评估
为什么值得看：命中与临床统计、研究工程或可信 AI 工作流直接相关的高信号主题；仍需阅读全文并回到官方文档、原始研究或供应商公告交叉核验。
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers “complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made substantial progress on robotics evaluations, and formalized the proof of Fermat’s Last Theorem in 30 hours.” The artificial intelligence (AI) company said high-stakes risks arising from misalignment remain low, and claimed the models matched or performed better than Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 on most alignment measures, resistance to misuse, honesty, and factuality. “It was roughly an order of magnitude less likely than Opus 5.5 and Sonnet 5.5 to publish harmful content to public package registries without encouragement, though it still did…
可转化方向：关注模型评估、可信 AI、监控与工程治理对实际 AI 工作流的启发