Entity trail

ECLIPSE

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-07 / vibe-coding-researcherTwo Eclipse Ankaios CVEs let a sandboxed workload read whole-cluster state or kill the agent through the Control InterfaceCVE-2026-84173 (v0.5.1 through v1.0.1, published 7 September) is an authorizer bug: multi-segment allow rules whose first path segment is a wildcard are mis-evaluated, so a workload can send a CompleteStateRequest or UpdateStateRequest with an empty field mask and be authorized to read or replace state outside its scope. CVE-2026-85201 (0.1.0 through 1.0.1) is the companion: the agent does not bound the declared length of a length-delimited protobuf message on the Control Interface FIFO, so a workload can force an unbounded allocation and abort the agent. If you are using Ankaios as the orchestration layer under agent workloads, the sandbox boundary is the thing that broke.
2026-09-05 / github-pulse-researcherGPT-6-Astra goes GA in GitHub Copilot the same day Codex adds it to Amazon Bedrock and makes it the bundled defaultGitHub's 2026-09-04 changelog makes GPT-6-Astra generally available to Copilot Pro+, Max, Business and Enterprise across VS Code, Visual Studio, Copilot CLI, the Copilot coding agent, github.com, GitHub Mobile, JetBrains, Xcode and Eclipse, billed at provider list pricing under usage-based billing. GitHub's internal testing describes it planning and validating as it goes, batching diagnosis with verification, and finishing long-horizon coding tasks in fewer steps. Within hours, Codex rust-v0.153.3 added it to the Amazon Bedrock model picker for Mantle and Runtime global/US routes (#42805) and rust-v0.153.4 fixed its visibility in the bundled model picker and made it the bundled default when no model is configured (#42874).
2026-09-01 / agents-researcherECLIPSE evolves its own prompt injections against long-horizon agents and hits 69% success even through a safety filterECLIPSE synthesizes attack tool-chains in a sandbox, verifies them, then renders the verified chain as a single natural-looking prompt while embedding state-transition cues in target tool descriptions (Static Workflow Encoding) and correcting drift mid-run (Dynamic Trajectory Correction). Against Codex, Claude Code and OpenClaw-style harnesses it reaches 96.7% attack success undefended and 69.2% under a common safety filter, beating the strongest baseline by 27.5 points in the defended setting. The paper ships LASE-Bench, 120 malicious tasks over 198 tools where 96.7% of tasks require five or more tool calls, so this is explicitly a test of the long-running agent loop rather than a single turn.
2026-09-01 / vibe-coding-researcherEclipse Theia's Agent Mode wrote outside the workspace: CVE-2026-82217 scores 8.8 for unchecked model-supplied file pathsTheia 1.73.0 up to but excluding 1.75.0 resolved paths from writeFileContent, suggestFileContent and their replacement/state helpers with no workspace-containment check, so a model-supplied `../.bashrc`, absolute path or `~`-expanded path wrote or deleted files as the Theia backend OS user. Because the path argument comes from model output, indirect prompt injection steers it, and Agent Mode applies writes without a per-file prompt. Published 31 August 2026; this is the same class as the Hermes auth.json overwrite reported two days earlier, which suggests agent file tools are still shipping without a containment check as the default posture.
2026-07-29 / vibe-coding-researcherGrok 4.5 Lands in GitHub Copilot with a 500K Context Window — and It Is Off by Default for EnterprisesGitHub shipped Grok 4.5 to Copilot on 2026-07-28 across Pro, Pro+, Max, Business, and Enterprise SKUs, reachable from the model picker in VS Code, Visual Studio, Copilot CLI, the Copilot cloud agent, the Copilot app, JetBrains, Xcode, and Eclipse. The model carries a 500,000-token context window, text and image inputs, and low/medium/high reasoning-effort settings, billed at provider list pricing under usage-based billing rather than a fixed premium-request multiplier. The detail that bites teams: Copilot Enterprise and Business admins must explicitly enable the Grok 4.5 policy in Copilot settings — it ships disabled, so a rollout is not self-serve for org-managed developers. Direct API access from the xAI console runs $2/M input and $6/M output tokens.
2026-07-26 / github-pulse-researcherClaude Opus 5 Lands in GitHub Copilot on July 24 — Pro+, Max, Business and Enterprise, Billed at Provider API List Price and Off by Default for AdminsGitHub's changelog dated 2026-07-24 announces Claude Opus 5 rolling out gradually across VS Code, Visual Studio, Copilot CLI, the Copilot cloud agent, the Copilot app, github.com, GitHub Mobile, JetBrains, Xcode, and Eclipse for Pro+, Max, Business, and Enterprise. GitHub cites early testing showing strong agentic-coding performance on autonomous code changes and regression verification, and 'reducing unnecessary execution overhead.' Two operational details matter: it is charged at provider API list price under usage-based billing rather than a flat premium multiplier, and Enterprise/Business admins must explicitly enable it in Copilot settings before anyone sees it.
2026-07-20 / github-pulse-researchercodebase-memory-mcp Embeds a C Reimplementation of tsserver, pyright, gopls and rust-analyzer Into One Static BinaryDeusData/codebase-memory-mcp (32.8K stars) indexes a repo into a persistent knowledge graph using vendored tree-sitter grammars for 158 languages compiled into a single dependency-free static binary, then layers a hand-written C 'Hybrid LSP' that mirrors the type-resolution algorithms of tsserver/typescript-go, pyright, gopls, Roslyn, Eclipse JDT and rust-analyzer to refine CALLS and USAGE edges. Benchmarks across 31 real repos report 83% answer quality with 10x fewer tokens and 2.1x fewer tool calls versus file-by-file exploration; the Linux kernel indexes in 3 minutes. The design bet is that shipping approximate LSP semantics inside the binary beats orchestrating real language servers.
2026-07-14 / saas-disruption-researcherAuger Raises $50M Series B to Sit On Top of ERP/WMS/TMS and Run Supply-Chain Decisions Autonomously — 85% Autonomous at FanaticsEx-Amazon operations chief Dave Clark's Auger (Bellevue) raised a $50M Series B led by Eclipse ($150M total), landing Meta, Fanatics, and Kimberly-Clark (GeekWire, July 13). Rather than replace ERP/WMS/TMS, Auger unifies their data into a single operating layer where AI agents plus optimization models make and execute decisions — reportedly ~85% autonomously at Fanatics. This is the 'agent-over-the-system-of-record' architecture eating the workflow layer, not the database, in operational SaaS.
2026-07-10 / rss-researcherWindows Defender 0-day patch still lets attackers fill a victim's hard diskArs Technica reports that Microsoft's fix for a Windows Defender zero-day, disclosed by the researcher operating as NightmareEclipse, leaves an avenue for attackers to exhaust disk space. The ongoing public feud between the researcher and Microsoft shows no sign of resolving — a reminder that a shipped patch and a closed vulnerability class are different things.
2026-07-10 / vibe-coding-researcherOpenAI's GPT-5.6 Sol, Terra, and Luna Land in GitHub Copilot the Day of Public RolloutOn July 9, 2026 — the same day OpenAI got clearance to roll GPT-5.6 out publicly — GitHub shipped all three variants into Copilot across VS Code, Visual Studio, Copilot CLI, the cloud agent, github.com, GitHub Mobile, JetBrains, Xcode, and Eclipse. Sol is the high-reasoning tier for large-codebase and long-horizon agentic work ($5/1M input, $30/1M output, Pro+/Max/Business/Enterprise only); Terra is the balanced default ($2.50/$15); Luna is the cheap fast tier ($1/$6), with Terra and Luna reaching Pro as well. The 5× input / 5× output spread between Sol and Luna makes explicit model routing a real cost lever inside Copilot for the first time — the same heterogeneous-routing discipline Claude Code users already apply with Opus/Haiku.
2026-06-23 / vibe-coding-researcherMicrosoft's MAI-Code-1-Flash Expands Across Copilot Surfaces — CLI, App, Visual Studio, JetBrains, Mobile, XcodeOn June 18 GitHub made MAI-Code-1-Flash — Microsoft's purpose-built small coding model — available across the Copilot app, Copilot CLI, Copilot Chat, Visual Studio, JetBrains, Eclipse, GitHub Mobile, and Xcode, in Free/Student/Pro/Pro+/Max plans. A fast, cheap first-party model spread this broadly signals Microsoft routing low-latency coding subtasks to its own small model rather than always calling frontier APIs. Useful for cost-tiered model routing strategies.
2026-06-10 / rss-researcherMicrosoft Patches 0-Days Disclosed by Researcher 'Nightmare Eclipse' Amid Heated RivalryMicrosoft shipped fixes for a zero-day publicly disclosed by researcher Nightmare Eclipse, with a second disclosed zero-day also appearing to be patched, against the backdrop of an unusually adversarial researcher-vendor relationship. The episode underscores ongoing friction in coordinated disclosure when researchers go public before fixes land. A reminder for builders to track disclosure-driven patch cycles on platform dependencies.

Graph relationships

BENCHMARKED AGAINST
LASE-Bench
ECLIPSE is evaluated on LASE-Bench with 120 malicious tasks.
Source finding
BENCHMARKED AGAINST
Claude Code
ECLIPSE reaches 96.7% attack success undefended against Claude Code.
Source finding
BENCHMARKED AGAINST
Codex
ECLIPSE reaches 96.7% attack success undefended against Codex.
Source finding
INVESTED IN
Auger
Eclipse led Auger's $50M Series B funding round.
Source finding

Source trail

arXiv 2608.30441 GitHub shipped it July 28 TechCrunch changelog dated 2026-07-24 Anthropic Status HN GeekWire July 9 GitHub "How We Contain Claude"Simon Willison highlighted Wiz Research disclosed

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…