A single daily edition of announcements from the AI coding tools you use, read from a curated source list, summarised, and linked back to the original. No infinite feed, no account, no advertising.
A stranger's GitHub issue was enough to run code through your coding agent
Novee Security's Elad Meged found that a GitHub issue opened by an anonymous stranger with zero privileges was enough to trigger the agent and smuggle prompt-injection payloads past the harnesses of Anthropic's Claude, Google's Gemini CLI and OpenAI's Codex, reaching remote code execution, credential theft and supply chain compromise. The flaws sat in shell command validation mismatches, unenforced allowlists and improper secret sanitisation rather than in the models, and Google rated the Gemini CLI case 10.0 on CVSS. All three vendors have shipped patches, and over 100 public repositories beyond these three show the same pattern.
The agent frameworks you build on carry deserialization and path-traversal bugs
Check Point's Yarden Porat and Shahar Tal disclosed 11 vulnerabilities across six agent frameworks at Black Hat, after a year-long review: LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK. The bug classes are insecure deserialization, server-side request forgery, path traversal and use-after-free: Microsoft's framework allowed remote code execution through untrusted checkpoint loading, where one person's message plants the payload and another person's session rewind runs it, and Google ADK left a file-writing development assistant reachable over HTTP without authentication on Cloud Run. Microsoft has fixed its issue and Google has partly fixed its own; the researchers' advice is to assume prompt injection will happen and stop injected content from crossing into orchestration logic, memory, routing and system instructions.
Clicking approve on agent commands catches only two threats in three
A browser game putting players in the human-in-the-loop seat for an AI coding agent collected 409,000 approve-or-deny decisions across more than 40,000 runs, and reviewers reached a mean accuracy of 66.3%. Scope violations that reached credentials were missed 35.0% of the time and exfiltration or code execution 33.4%, while 7% approved every prompt they saw. The single most-missed command was npm run analyze, waved through 64.7% of the time, with a malicious payload visible in the history log behind the familiar script name.
Claude Code sessions can now run on your own machines and message each other
Version 2.1.224 adds a self-hosted-runner command that runs web, mobile and desktop sessions on your own machines or containers, on Team and Enterprise plans. Cross-session SendMessage lets sessions on any of your machines message each other, with ListAgents to discover them, on macOS and Linux, and messages into a session running with bypassed permissions are held for approval through a new crossSessionInbound setting. The release also removes the 200-subagent-per-session spawn limit and adds an archive plugin source that installs from a zip over HTTPS with optional SHA-256 pinning.
