The briefingSecurity
Loading Ashlr Brief
Phantom Secrets' proxy now offers a post-quantum hybrid key exchange, and Lexicon closed a race that could mark untrusted terms as trusted.
On October 18, 2026 (US Eastern time) the Ashlr team merged several pull requests into its public repositories. This story covers the two that touch security. Each statement below comes from the pull request title and description, and we checked on GitHub that each one shows as merged. A merge means the change is in the main branch. It does not by itself mean it is in the version you have installed, so check each project's release notes.
Phantom Secrets is the open-source tool that keeps real API keys out of an agent's sight. It includes a proxy that adds the real key to a request on the way out. Pull request 282 changes how that proxy opens secure connections to the outside servers. The description says it now offers a hybrid key-exchange group called X25519MLKEM768 and lists it first. Before, it offered x25519, secp256r1 and secp384r1. The description says the team confirmed this by capturing the real handshake the proxy sends, before and after.
In plain terms, "hybrid" means two methods are combined: a classic one and a newer one designed to hold up against future quantum computers. The usual reason to adopt it early is that traffic recorded today could be read later if only the old method protected it. That reasoning is general background, not a claim from the pull request.
The description is careful about limits. It says this is an offer only, so whether the hybrid method is actually used still depends on the server on the other end. Certificate checking is unchanged. The release binary grew from 34,674,648 to 34,812,456 bytes, which it puts at 0.4 percent on Linux x86_64. It says macOS, Windows and ARM64 were not tested by the author, and that the project's automated checks cover them.
Lexicon is the open-source file of custom words that fixes what speech-to-text gets wrong. A project can carry its own lexicon file, and Lexicon only uses it after you mark it trusted. Pull request 124 fixes a timing gap. The description says that when you added a term, the trust check ran before the file was locked. If someone replaced the file in that short window, for example through a git pull or a sync tool, its unreviewed terms could be merged and marked as trusted. The fix re-checks trust on the exact bytes being merged, and also covers removing terms and the install rollback.
The description says seven new tests hold the lock, swap in a hostile file and release it. On the old code, 4 of the 7 failed. It reports the full suite passing locally with 1,796 tests passed and 2 skipped. It also lists four lower-severity issues it did not fix, including that the registry fetch checks only the final redirect address. A related change merged earlier that day, pull request 130, makes the clipboard daemon, voice mode and setup skip parsing an untrusted lexicon file at all, so those paths read nothing from a file you have not trusted.
The Lexicon fix is a good pattern to copy: check trust against the same bytes you then use, not a separate earlier read. For the TLS change, the useful habit is the evidence. The author captured the real handshake before and after instead of trusting the config.
Two things are worth noticing. The descriptions state what was not tested and what was left unfixed, which is the kind of honesty to ask any vendor for. And the post-quantum change is an offer, so nobody should claim the traffic is now quantum-safe.
If you use Phantom Secrets or Lexicon, update when the next release notes mention these pull requests. If you build anything that trusts a file from a shared repository, check that your trust check and your read use the same bytes.
Ashlr tools connected to this story. Review their source and setup requirements.
Keep a personal vocabulary of names and speech-to-text corrections in one YAML file, then use it across coding-agent tools, MCP connections, and browser workflows.
Source material behind this briefing. Our practical implications are Ashlr’s interpretation.
This briefing was prepared with AI assistance from the linked sources. The analysis may include interpretation; consult the original sources for complete context. Cover artwork is illustrative.
In about a day, Phantom Secrets merged fixes so a locked vault, a symlink swap or a dependency notice produces a clear answer instead of an empty one.
Agents can read your .env file like any other file. Phantom Secrets swaps real keys for placeholders and adds the real one only when a request leaves.
Agents inherit whatever accounts happen to be logged in on your computer. Locus pins an agent to one identity, so acting as the wrong client becomes impossible.
Delegate supported API work through scoped placeholders and a local proxy, keeping real keys out of agent context.
