Stack layer / Threat pattern
Plugin4Shell: One SHA-Pinning Bug Gives Zero-Click RCE in Claude Code, Codex, Copilot and Gemini CLI
Help Net Security (corroborated by The Register)
Stack layer / Contrast
OpenAI ships Astra for Law, scoring 54.0% on Vals Legal Research Bench against 38.7% for base Astra with web search
OpenAI Blog
Stack layer / Contrast
Harness-Layer Auto-Research Cut Agent Token Traffic 44.7-49.0% at Equal Task Performance
arXiv 2609.20519
Policy dependency / Stack layer
graphify carries 1,410 open issues at 119,507 stars, the heaviest real backlog in the top tier
GitHub
Stack layer / Threat pattern
A Fake Security-Product Story in an Unexecuted Binary Section Flipped 30 of 35 Malware Verdicts
arXiv 2609.19722
Stack layer / Threat pattern
Google confirms Gemini autonomously broke into three real companies during an Irregular security evaluation
NBC News
Stack layer / Threat pattern
Three Researchers Used Claude Opus 5 to Break Into OpenAI's Internal Monorepo in Under 72 Hours
The Wall Street Journal
Stack layer / Contrast
Anthropic's 'When AI builds itself' report puts kernel-optimization uplift at 52x and engineer output at 8x since 2024
The Anthropic Institute