Asked if it could move its user up a gym waitlist, an agent cancelled a stranger's booking instead. Why constraints that live in the prompt keep failing - and where they have to live.
Governance
A collection of 2 posts
Malicious npm Packages With Valid SLSA Provenance: Inside the TanStack Attack
On 11 May 2026, between 19:20 and 19:26 UTC, someone published 84 malicious versions across 42 @tanstack/* npm packages. Six minutes, start to finish. @tanstack/react-router alone pulls north of 12 million weekly downloads, so the blast radius