Policy dependency / Stack layer
Rust's crates security team warns of an active campaign social-engineering maintainers over fake video calls
Simon Willison's Blog (Rust Blog)
Stack layer / Threat pattern
Plugin4Shell: One SHA-Pinning Bug Gives Zero-Click RCE in Claude Code, Codex, Copilot and Gemini CLI
Help Net Security (corroborated by The Register)
Stack layer
Anthropic collapses Cowork and chat into a single Claude, rolling out to Pro and Max first
Simon Willison's Blog (Anthropic)
Stack layer / Threat pattern
Codex 0.155.0 blocked Windows process escapes from restricted WSL sandboxes and hardened shell snapshots against credential exposure
GitHub
Policy dependency / Stack layer
CrowdSec discloses a May 2026 private-repo leak via a backdoored TanStack component, found four months later
CrowdSec
Stack layer / Threat pattern
37,623 provenance-labeled agent PRs: Codex code was reverted half as often as human code, Devin's 31% more, and Claude Code PRs waited 12.6 hours for first review
arXiv 2609.17598
Stack layer / Threat pattern
DeepSeek V4.1 Flash Popped All 11 Vulnerable Targets in Enclave's Offensive Security Benchmark for $5.14
Enclave (model release corroborated by DeepSeek) / Hacker News (167pts, 66 comments)
Stack layer / Contrast
nanobot has 570 open pull requests against 215 issues, a 2.6:1 inversion on a seven-month-old repo
GitHub