OSSCheckpoints — M Seed for AI Code Provenance CLICheckpoints·high signalXBlueskyLinkedInCopy linkEx-GitHub CEO Thomas Dohmke's open-source CLI recording AI code reasoning trails. M seed at M valuation. Most well-funded bet on AI code provenance.SourceSource pageCheckpoints↳ Follow the threadStack layer / Threat patternPlugin4Shell: One SHA-Pinning Bug Gives Zero-Click RCE in Claude Code, Codex, Copilot and Gemini CLIHelp Net Security (corroborated by The Register)Policy dependency / Stack layerLangChain ships a first-party integration that deliberately does not wrap the vendor's SDKGitHubStack layer / Threat pattern37,623 provenance-labeled agent PRs: Codex code was reverted half as often as human code, Devin's 31% more, and Claude Code PRs waited 12.6 hours for first reviewarXiv 2609.17598Stack layer / Threat patternDeepSeek V4.1 Flash Popped All 11 Vulnerable Targets in Enclave's Offensive Security Benchmark for $5.14Enclave (model release corroborated by DeepSeek) / Hacker News (167pts, 66 comments)Policy dependency / Stack layerThree SBOM Generators Diverge Systematically on 3,000 Projects, 14 Months Before the CRA Makes SBOMs MandatoryarXiv 2609.19920Policy dependency / Stack layerCopilot CLI 1.0.86 stops autopilot from running past an accepted task and recovers sessions from corrupt transcriptsGitHubStack layer / Threat patternGoose 1.51.0 deletes planning mode and the recipe-creation command from the CLIGitHubStack layer / ContrastRecording an Agent Run at Its Non-Deterministic Boundaries Turns an Incident Into a CI Regression TestarXiv 2609.20625