Build guide

Build a cybersecurity news account on X
breaches, ransomware, advisories

Pick a few of the 14 security feeds below, let the AI write one useful line per story, and post it to X every 15 minutes. No X developer account, no per-post billing, and no five posts about the same breach.

Card required, cancel any time.

The short answer

Add a security RSS feed such as https://www.bleepingcomputer.com/feed/ to the OpenTweet RSS connector, write a prompt that says who is affected and what to do, and set it to check every 15 minutes. Each new story becomes one post on your X account. To combine several outlets in one account without duplicates, run a short script that skips headlines already covered and posts the rest to POST https://opentweet.io/api/v1/posts.

Security is one of the most common things OpenTweet API accounts post: in the 30 days to November 3, 2026, 22 paying accounts published 458 security news posts, and the four busiest posted 185, 163, 40 and 29.

14 security feeds that work with the connector

Tested on November 3, 2026 with the OpenTweet connector's user agent. Every feed returned 200 with items from the last week. Item counts are how many the feed returns at a time. Feeds change, so check yours with the RSS feed preview before you rely on it.

SourceFeed URLItemsGood for
BleepingComputerhttps://www.bleepingcomputer.com/feed/15Breaches, ransomware, malware. Fast on incidents.
The Hacker Newshttps://feeds.feedburner.com/TheHackersNews50High volume, includes images. Filter out sponsored posts.
Krebs on Securityhttps://krebsonsecurity.com/feed/10Few posts, deep investigations. Worth every one.
The Record (Recorded Future News)https://therecord.media/feed5Government, policy and nation-state stories.
SecurityWeekhttps://www.securityweek.com/feed/10Vendor advisories, funding, industry news.
Dark Readinghttps://www.darkreading.com/rss.xml50Broad. Includes opinion pieces; filter them.
Help Net Securityhttps://www.helpnetsecurity.com/feed/10Releases, tools and surveys.
CyberScoophttps://cyberscoop.com/feed/10US policy and law enforcement.
The Register, Securityhttps://www.theregister.com/security/headlines.atom50Atom feed. Opinionated headlines.
SANS Internet Storm Centerhttps://isc.sans.edu/rssfeed_full.xml10Daily diaries from handlers. Technical audience.
Schneier on Securityhttps://www.schneier.com/feed/atom/10Atom feed. Commentary, not breaking news.
UK NCSChttps://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml20Official UK guidance, news and advisories.
CISA advisorieshttps://www.cisa.gov/cybersecurity-advisories/all.xml30Official US advisories, including ICS.
Google Project Zerohttps://googleprojectzero.blogspot.com/feeds/posts/default10Atom feed. Rare, high-signal research posts.

Not listed: Microsoft's Security Update Guide RSS returned no items on November 3, 2026. For news beyond security, see the 64 tested news feeds.

Six post types for a security news account

Headlines alone get skimmed. The accounts people follow say in one line who should care and what to do.

Incident

Event-driven

A breach or ransomware attack. Who was hit, what was taken, and whether customers need to act.

Advisory

Event-driven

From CISA or the NCSC: which product, how bad, and the fix. Official sources get reposted the most.

Campaign

Event-driven

A new malware family or phishing wave, with the one thing readers should look for.

Arrest or takedown

Event-driven

Law enforcement actions. Short, factual, from The Record or CyberScoop.

Patch Tuesday

Scheduled

Second Tuesday of the month (November 10 and December 8, 2026). Lead with what is already exploited.

Weekly recap

Scheduled

The five stories that mattered, as one thread every Friday, for people who check once a week.

No code: one connector per beat

The connector reads the feed, hands each new item to the AI with your prompt, and posts the result. It checks every 5 or 15 minutes if you choose, posts the newest items first, and skips anything older than 48 hours. The skip rule in the prompt keeps webinars and sponsored posts out of your timeline.

Connectors  ->  New connector  ->  Blog or newsletter (RSS)

  Feed URL:   https://www.bleepingcomputer.com/feed/
  Prompt:     One post for security people. First line: who is
              affected and what happened. Second line: what to do,
              if the story says. Keep company names, numbers and
              CVE IDs exactly as written. No emoji, no "BREAKING".
              If the item is sponsored, a webinar, a product
              promo or has no facts, skip it.
  Frequency:  Every 15 minutes
  Include link: Only for the big ones (turn off for all-text)
  X account:  @yoursecnews

Pro includes 5 connectors and 10 connector posts a day; Advanced has unlimited connectors and 50 connector posts a day.

Many outlets, one account, no duplicates

Connectors remember items per feed, so two outlets covering one breach give you two posts. This script pulls several feeds, skips a headline when half its key words match a story posted in the last 48 hours, and posts at most six stories a run. Run it every 15 minutes with cron or a scheduled GitHub Action. The first run only records what is already in the feeds.

Python

import json, pathlib, re, time
import feedparser, requests          # pip install feedparser requests

OT_KEY = "ot_your_key"
FEEDS = [
    "https://www.bleepingcomputer.com/feed/",
    "https://therecord.media/feed",
    "https://feeds.feedburner.com/TheHackersNews",
    "https://krebsonsecurity.com/feed/",
]
STATE = pathlib.Path("posted.json")
state = json.loads(STATE.read_text()) if STATE.exists() else {"links": [], "recent": []}
STOP = {"the", "a", "an", "to", "of", "in", "on", "for", "and", "with", "new", "after", "by", "as", "is", "are", "at", "from"}

def words(title):
    return {w for w in re.findall(r"[a-z0-9-]+", title.lower()) if w not in STOP and len(w) > 2}

def same_story(title):
    w = words(title)
    for r in state["recent"]:
        old = set(r["words"])
        if w and len(w & old) / len(w | old) >= 0.5:   # half the key words match
            return True
    return False

first_run = not STATE.exists()
cutoff = time.time() - 48 * 3600
state["recent"] = [r for r in state["recent"] if r["at"] > cutoff]
posted = 0
for url in FEEDS:
    for e in feedparser.parse(url).entries[:10]:
        if e.link in state["links"]:
            continue
        if first_run or same_story(e.title):
            state["links"].append(e.link)                  # remember, don't post
            continue
        if posted >= 6:                                    # at most 6 posts per run;
            break                                          # the rest wait for the next run
        text = e.title.strip()                             # or ask your model for one line
        r = requests.post(
            "https://opentweet.io/api/v1/posts",
            headers={"Authorization": f"Bearer {OT_KEY}"},
            json={"text": text[:280], "publish_now": True},
            timeout=30,
        )
        if r.ok:
            posted += 1
            state["links"].append(e.link)
            state["recent"].append({"words": sorted(words(e.title)), "at": time.time()})

state["links"] = state["links"][-2000:]
STATE.write_text(json.dumps(state))

The Friday recap thread

The first post is text; the rest go in thread_tweets. Schedule it once and it goes out on time.

curl -X POST https://opentweet.io/api/v1/posts \
  -H "Authorization: Bearer $OPENTWEET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "The 5 security stories that mattered this week. A thread.",
    "is_thread": true,
    "thread_tweets": [
      "1/ Story one: who was hit, how, and what to check.",
      "2/ Story two ...",
      "3/ Story three ...",
      "4/ Story four ...",
      "5/ Story five ... Patch Tuesday is next Tuesday, November 10."
    ],
    "scheduled_date": "2026-11-06T16:00:00Z"
  }'

Want the model to write the line instead of reusing the headline? Connect Claude Code, Cursor or ChatGPT to the OpenTweet MCP server and have it draft each story for you to approve, or call your model inside the loop above. Every field is in the API reference.

Which plan fits your account

Flat monthly price. The deciding numbers are posts a day and how many carry a link.

Account typeTypical volumePlan
One beat, summaries without links5-15 posts a dayPro, $19.99/mo, 20 posts a day
Several outlets, links on the big storiesUp to 10 link posts a dayAdvanced, $29/mo, unlimited connectors
One account per region or language50+ posts a dayAgency, $49/mo, 300 posts a day

Link posts: Pro 1 a day, Advanced 10, Agency 20, plus link credits. See pricing, or why links cost reach on X.

Facts from the article. Company names, victim counts and CVE IDs come from the story, never from the model. A wrong victim name is a correction you have to post in public.

No leaks, no payloads. Do not post leaked data, credentials, ransom notes with contact details or exploit code, even when the article links to them.

Label it and credit sources. Turn on the Automated label, name the outlet in the post, and do not auto-tag the companies in the story. More in X automation rules and can you post news headlines on X.

Frequently asked questions

What are the best RSS feeds for a cybersecurity news account?

For breaking incidents: BleepingComputer, The Record and The Hacker News. For depth: Krebs on Security and SANS Internet Storm Center. For official advisories: CISA and the UK NCSC. All 14 feeds on this page returned 200 with fresh items to the OpenTweet connector on November 3, 2026. Microsoft's Security Update Guide RSS returned no items that day, so it is not listed.

How do I stop the same breach being posted five times?

Every outlet covers the big stories, so five feeds give you five posts about one breach. OpenTweet remembers each feed's items, not stories across feeds. Either keep one connector per beat (one breaking-news feed, one advisory feed, one research feed), or run the script on this page, which skips a headline when it shares most of its key words with something posted in the last 48 hours.

Can an AI write the posts without making things up?

Yes, if it only rewrites the item it was given. The connector passes the title, summary and link to the model; the prompt on this page tells it to say who is affected and what to do, to keep names, numbers and CVE IDs exactly as written, and to skip the item when the summary has no facts. Read the first day of posts before you leave it running.

Should every post include the article link?

Not every one. Each post with a URL is a link post: $0.20 on the X API and part of your OpenTweet link allowance (1 a day on Pro, 10 on Advanced, 20 on Agency). Most security accounts post the summary without a link and add the link to the stories people will want to read in full, such as a major breach or a new campaign write-up.

How fast does the connector pick up a new story?

Every 5 or 15 minutes if you choose it. The connector posts the newest items first, remembers the last 2,000 items it saw, and skips anything older than 48 hours, so a feed that reshuffles old stories does not flood your timeline.

Is this different from a CVE alert bot?

Yes. A CVE bot posts records from CISA KEV and NVD: IDs, products and patch dates. A news account posts stories: breaches, ransomware gangs, arrests, policy. Many accounts run both. The CVE side is on the CVE alert bot page.

Will X limit an automated security news account?

Original posts on your own timeline are fine. Turn on the Automated label in your X settings, post each story once, and do not auto-reply to or tag the companies in the story. Never post leaked data, credentials or working exploit code, even when an article links to them.

Posting vulnerability records instead of stories? See the CVE alert bot. Covering a different beat? See the AI news account, the news aggregator account, or the job board bot.

Everything you can build on X with OpenTweet

Post to X from your code, a feed, or an AI agent. Start anywhere in the cluster.

OpenTweet vs the X API

Post, schedule, and automate X without a developer account or the $200/mo minimum.

X DM outreach, human-approved

Find and qualify leads, AI-draft DMs, approve each one, and drip-send from your own account via API or MCP.

Post to X without an API

The clean, account-safe way to post to X from your code or an AI agent.

Twitter MCP Server

Give Claude, Cursor, and OpenClaw the ability to post to X. 44 tools included.

Developer docs

Quickstart, API keys, MCP setup, and the REST reference for posting to X from code or an agent.

Cross-posting reference

One call posts to X, Bluesky and LinkedIn. The platforms field, per-network results, and why a network gets skipped.

Social media API for AI agents

Three ways an agent can post to X, Bluesky and LinkedIn, and the trade-offs of each.

LinkedIn MCP server

Post and schedule to a LinkedIn profile from Claude or Cursor through the official LinkedIn API.

XMCP vs OpenTweet

X's official MCP server bills per API call and cannot schedule. Compare it with the flat-fee hosted MCP.

MCP for AI agents

Connect your AI client to X in under two minutes, no X developer account.

Developer API and keys

REST endpoints, one bearer key, and usage tracking. Build on OpenTweet.

OpenTweet for AI agents

The posting layer for autonomous agents and automations that live on X.

Build an AI Twitter persona

Give your AI agent its own X account. Setup, cadence, and the rules that keep it safe.

Best MCP servers for social media

The 2026 ranked list. How the hosted OpenTweet MCP compares with the official X MCP and others.

Best API to post to X

Seven options priced at real volumes, and why links decide the bill.

Cheapest way to post to X via code

Flat fee vs pay-per-use. Why the $0.20 per-link fee flips the math past ~145 link posts a month.

X API pricing 2026

Every pay-per-use X API endpoint price from docs.x.com in one searchable table.

Bluesky posting API

Post and schedule to Bluesky with one REST call and OAuth, and cross-post to X and LinkedIn in the same request.

Automate LinkedIn posts

Post to LinkedIn from an AI agent, n8n or a script through the official Posts API, with one REST or MCP call.

Launch your security news account today

Connect X, add one feed, and the next story goes out within 15 minutes.