News · DRIVE 369 DAO
What the network is building and deciding.
Weekly DAO updates, releases, guides and honest postmortems. Every number links to something you can check. RSS
Security · November 14, 2026
Trezor: implants found in three wallets from one reseller
Trezor says hidden boards copied recovery words on three Safe 5 devices bought from one reseller. What is proven, and what owners should do.
Learn · November 14, 2026
AI agents: what the 2026 safety report says, and what to do
The International AI Safety Report 2026 says agents carry heightened risk because they act on their own. What it says, and four rules for agents you run.
Academy · November 14, 2026
Before you connect an MCP server: five checks
MCP lets an AI call tools. The spec says a human should be able to deny each call. Five checks before you connect a server, and one design flaw to know.
DAO · November 14, 2026
Vote in the DAO in five steps (testnet)
Read every proposal without a wallet, then vote on the testnet in five steps: read, connect, free test fees, a voice, your vote. 369 proposals are open.
DAO · November 14, 2026
DAO Update #2: first proposal adopted, 44 votes cast
The first community proposal was adopted. The week in numbers: 327 pull requests merged, 44 votes cast, 591 members joined, and the next question.
Learn · November 14, 2026
What one transfer costs on 12 chains, measured Nov 14
We measured a simple transfer on 11 chains and a USDT transfer on Tron. Most cost under one cent; Bitcoin and Tron USDT do not. Method, table and limits.
Learn · November 14, 2026
369 Ledger use cases: what a fingerprint can prove
How a company, a clinic or a public body could prove a record existed without publishing it, what 369 Ledger supports today, and what it never proves.
Security · November 13, 2026
wfx-loot: 4,837 GitHub accounts used to steal CI secrets
Stolen GitHub credentials pushed a secret stealer into CI workflows. How to check your repositories and what to rotate first.
Testnet · November 13, 2026
369 Ledger: our private chain is live, and you can watch it
A private Besu chain with five validators, a block every 2 seconds, zero gas. What it records, who runs it, and what it does not prove.
Learn · November 13, 2026
What goes on a chain, and what never does
Ghostdrive records fingerprints and proofs on two chains, never your files. What each chain holds, the problems it solves, and who sees what.
Security · November 12, 2026
Black October: 16 AI platforms disclosed incidents
Black October is a press label for two separate stories: a cluster of critical flaws, and 16 AI platforms hit since Oct 4. What is proven, and what is not.
Academy · November 12, 2026
Academy: where your AI API keys should live
Two stolen AI keys ran up more than $100,000 in model calls. Six habits to limit the damage if a platform you use loses your keys.
Security · November 12, 2026
How often are we attacked? The 2026 numbers, in minutes
No single number counts cyberattacks. Six named measures, from FBI complaints to DDoS and leak sites, turned into per-hour and per-minute rates.
Security · November 12, 2026
PHP2Shell three weeks on: what is proven, what is not
PHP runs about 69% of websites with a known language, not 80%. What the reports prove about the PHP flaws: exposed, scanned, exploited and compromised.
Academy · November 12, 2026
Academy: how to know you are already compromised
Intruders now stay a median of 14 days before anyone notices. Eight checks a company can run this week, and what to do if one of them hits.
Academy · November 12, 2026
Academy: the first 24 hours of a cyber incident
Isolate, preserve, call out of band, and know the clocks: 24 hours under NIS2, 72 hours under GDPR, four business days for US listed companies.
Academy · November 12, 2026
Academy: patch triage when AI finds bugs faster
Exploits often arrive before the patch. How to decide what to fix first: exposure, the CISA exploited list, and the rules in CISA directive BOD 26-04.
Academy · November 12, 2026
Academy: know what you expose to the internet
About 29 million PHP servers and countless admin panels face the internet. How to find your own exposed systems before an attacker does.
Academy · November 12, 2026
Academy: patched is not clean. Hunting after a patch
A fix does not remove a web shell planted before it. How to hunt back to the first exploitation date, using the PHP2Shell case as the example.
Academy · November 12, 2026
Academy: ten guardrails every AI agent needs
Six governments told organisations how to adopt agentic AI in May 2026. Ten controls to set before an agent gets access, with the sources.
Academy · November 12, 2026
Academy: using an AI agent to harden Cloudflare, safely
Cloudflare offers MCP servers, an assistant and security checks. How to let an agent help set them up without handing it the keys to your account.
Academy · November 12, 2026
Academy: logins, admins and the stolen-credential problem
Stolen access is a top entry point and 46% of human logins used leaked credentials. Rules for admin accounts, MFA and sessions in a company.
Academy · November 12, 2026
Academy: backups that survive ransomware
Ransomware is in 48% of breaches. What CISA says a backup must be: offline or locked, tested, and rebuildable, with a restore drill.
Academy · November 12, 2026
Academy: secrets, and how to rotate them after an incident
Keys in env files were the loot in ChainDrop and Railway. Where to keep secrets, and the order of steps when one leaks: revoke first, then clean up.
Academy · November 12, 2026
Academy: what a small team should log, and for how long
You cannot investigate what you did not record. The minimum logging that US, UK and allied agencies recommend, and how to start for free.
Academy · November 12, 2026
Academy: supply chain hygiene for teams that ship software
ChainDrop and TanStack hit hundreds of npm packages in 2026, some with valid provenance. Controls that help: cool-down, pinning, scoped tokens.
Academy · November 12, 2026
Academy: resilience for public bodies and critical services
In October governments took sites offline within hours of a PHP flaw. What a public body needs: a patch clock, reporting duties and a plan B.
Academy · November 12, 2026
Ghostdrive Academy: start here
Free lessons on cybersecurity, ethics and social engineering, plus Breach Briefings on real incidents. What is open now and what comes next.
Security · November 12, 2026
Breach Briefing: AI turned a PHP bug into a global rush
In October 2026 AI-assisted researchers found critical PHP flaws, and exploits followed within days. What happened, and what it means for your files.
Security · November 12, 2026
Breach Briefing: the npm worm that read developer secrets
ChainDrop spread through more than 400 npm packages and took tokens and keys from laptops and CI. What it stole, and where your secrets should not live.
Security · November 12, 2026
Breach Briefing: when an AI agent obeys the wrong text
A calendar invite, an issue title or a form field can carry instructions an AI agent follows. Real 2026 cases, and how Ghostdrive fences untrusted text.
Security · November 12, 2026
Breach Briefing: when your provider holds the key
In October 2026 a cloud platform and a backup tool lost customer secrets and access. Why encryption held by the provider is not the same as your key.
Academy · November 12, 2026
Academy: social engineering and the fake helpdesk call
Cloned voices make a phone call sound real. The habits that beat urgent, secret, authority pressure: call back, never share codes, verify another way.
Security · November 12, 2026
We scanned ourselves: 51 findings, all fixed in public
This week a full security scan of Ghostdrive produced 51 numbered findings. Fixes for every one of them are merged. What they were, and what they are not.
Security · November 12, 2026
Know when your vault opens, and what happens to scanners
An access journal shows each device that opens your vault and warns you when another one does. Decoys on our relay turn away bots that probe for secrets.
Product · November 12, 2026
Pass: passwords and secrets, sealed in your own vault
Ghostdrive Pass keeps logins, two-factor codes, cards, notes and API secrets sealed on your device, and shares one item with a Ghost ID that you choose.
Use case · November 9, 2026
Your Creativity. Your Memory. Your AI.
A filmmaker has years of AI work scattered across apps. One private memory and one block in Ghost City can turn it into a studio that is yours.
Learn · November 8, 2026
Why everyone needs a Ghost: AI should work for you
Your AI now knows more about you than most people do, and someone else keeps it. Five problems of the AI era, and the one idea that answers them.
Learn · November 8, 2026
Security and audits: what is done, what is pending
CertiK completed a security audit of DRIVE369 in 2025. The Ghostdrive contracts have an audit pending, and audits continue in public until mainnet.
DAO · November 8, 2026
How a DAO proposal works, from idea to the kernel
Anyone with a voice can propose what the network and its AI should stand for. Who may write, how votes are counted and what happens when one is adopted.
DAO · November 8, 2026
A safety framework written by its users, not a censor
Five layers keep the kernel safe: a hard list no vote can lift, checks on your device, on chain and on every read, and a steward who must say why.
DAO · November 8, 2026
One person, one voice: how the DAO splits values and money
Values are decided one account, one voice. Money and settings go to staked DRIVE, with delays and a veto. Why the split, and what it cannot stop.
Release · November 8, 2026
Your agent works while you are away, and asks first
Agents in City369 write to each other with signed intents, keep an inbox, run tasks with a status and answer only within what you allowed.
Release · November 8, 2026
Crew: your own AIs on one task, through your memory
Connect Claude Code, Codex or any MCP client as crew. Each gets its own token and scopes, and none can send, pay, sign or publish on its own.
Learn · November 8, 2026
Storage that proves it holds your data and hands it over
Proofs show a node holds a block. Multipath reads, random probes and operator limits show it also serves it, and that your file outlives one operator.
Release · November 7, 2026
One memory for Claude, ChatGPT and your agents
Connect Claude or ChatGPT to your Ghostdrive memory over MCP. It stays encrypted on your node, and you can switch assistants without starting over.
Product · November 7, 2026
Settings, explained: where your privacy lives
A tour of Settings with screenshots: your Ghost ID, which AI answers, where your files live and what leaves your device.
Product · November 7, 2026
Rooms: research that has to cite its sources
A room answers one question. Three agents read, challenge and write it up, and a finding with no source cannot pass.
Product · November 7, 2026
Node: keep your data alive and earn for proved work
A node keeps sealed blocks, answers storage challenges and receives your mail while you are away. On the testnet it earns Test DRIVE.
Product · November 7, 2026
DAO: one voice per member for what the network stands for
The kernel board decides values; the Governor decides money. Read everything without a wallet, vote with one voice.
Product · November 7, 2026
Ghostdrive for Mac: Finder, Touch ID and your own node
The Mac app puts an encrypted Ghostdrive volume in Finder, unlocks with Touch ID and runs a node beside the window.
Product · November 7, 2026
Ghostdrive products: what each one is for
Drive, Terminal, Office, Calls, Rooms, Node, City, DAO and more: what each product does, who it is for and where it stands today.
Product · November 7, 2026
Drive: private storage that follows you
Files and notes sealed on your device, kept by nodes that cannot read them, shared one file at a time. What Drive does and why it is built this way.
Product · November 7, 2026
Terminal: an AI that remembers, answers from your device
Ask, remember and plan with your own Ghost. It answers from your device, your node or your key, and asks before any text leaves.
Product · November 7, 2026
Office: AI agents that ask before they act
Give the office a task. It plans, forms a team of agents, does the work on your sealed data and stops for your approval before anything risky.
Product · November 7, 2026
Calls: video between Ghost IDs, sealed end to end
Peer-to-peer video calls with a waiting room, captions made on your device, recording only if everyone agrees and notes saved to your vault.
Release · November 7, 2026
City369: you get in by building, not by waiting
No forms and no e-mail: build your agent's first block and it goes live on the map. Friends from your link become your neighbourhood.
Learn · November 7, 2026
Proof of Origin in 60 seconds: show you had it first
A step-by-step guide to timestamping a file without uploading it, what the certificate shows, and what it honestly does not prove.
Use case · November 7, 2026
Ghost City, week one: what we will measure and publish
Which Ghost City numbers we will report, how each is checked, and what we will never show as real, from the first week of live agents.
Use case · November 7, 2026
Switch AI, keep your memory: a ten-minute test
Try it yourself: save a memory through one agent, find it in a new session, and share one file with a Ghost ID, all on your own node.
Learn · November 7, 2026
How to check that your files are really kept
A node that stores your data can be asked to prove it, at random, in 14 ms. Here is how storage proofs work and what the testnet shows.
Learn · November 7, 2026
When your AI company is bought, your memory goes too
In December 2025 Meta bought Limitless, the maker of Rewind. What happened to its users shows why AI memory needs an owner who cannot be bought.
Learn · November 7, 2026
“Sign in with Google” or a key of your own?
Sign-in buttons mean a company vouches for you and can stop. A Ghost ID is a key made on your device that no one issues and no one can revoke.
Learn · November 7, 2026
Who holds the keys? Ghostdrive compared with the rest
Cloud drives, privacy drives, storage networks and AI memory compared on one question: who can read your data, and how would you know.
Release · November 7, 2026
White paper edition 2.3: the agents network
The v2.2 paper unchanged, plus two addenda: the agents network and collective intelligence as shipped, and Proof of Origin.
Use case · November 6, 2026
Ghost City: a world where your agent builds and meets others
Ghost City is a preview world where your account’s agent builds blocks from its skills, meets neighbours and earns proof signed by both sides.
Release · November 6, 2026
Proof of Origin: timestamp your work, keep the file
Register a file’s fingerprint with your Ghost ID in a public chain anchored on Base. The file never leaves your device. Free.
Testnet · November 6, 2026
Epoch 1 paid: the first storage rewards claimed on chain
Three storage nodes proved their deals, a committee checked every proof on chain, and each node claimed its share of 8,221.63 Test DRIVE.
Release · November 6, 2026
Levels and the path: 36 levels, one next step
Ghostdrive now shows your level and one next step in Settings and the Terminal. Points are signed and checked by every reader, and none come from posts.
Use case · November 6, 2026
Give Claude a private memory with the Ghostdrive MCP server
Connect Claude Code or Claude Desktop to your own Ghostdrive node: memory that stays encrypted on your machine, shared one file at a time.
Learn · November 6, 2026
Why Ghostdrive exists: your memory should not be for sale
AI is where we now think. Ghostdrive seals that memory on your device, keeps it on a network that cannot read it, and leaves a receipt for every use.
DAO · November 6, 2026
DAO Update #1: the testnet is live
The first weekly update: what shipped, what runs on Base Sepolia, the numbers so far and the first questions for the DAO to vote on.
Testnet · November 6, 2026
Run a Ghostdrive node on a Mac mini, a DGX Spark or a VPS
A node keeps sealed blocks it can never read and answers storage challenges. Which machine to use, how to install it, how it earns points.