Stack layer / Threat pattern
Plugin4Shell: One SHA-Pinning Bug Gives Zero-Click RCE in Claude Code, Codex, Copilot and Gemini CLI
Help Net Security (corroborated by The Register)
Policy dependency / Stack layer
LangChain ships a first-party integration that deliberately does not wrap the vendor's SDK
GitHub
Policy dependency / Stack layer
CrowdSec discloses a May 2026 private-repo leak via a backdoored TanStack component, found four months later
CrowdSec
Policy dependency / Threat pattern
Gary Marcus: the near-term threat is agentic AI hacking, not rogue superintelligence, and labs should be liable
Marcus on AI (Gary Marcus)
Policy dependency / Stack layer
Figure's Helix 2.5 raises zero-shot household task success from 9% to 56% across 30 homes it never trained on
Figure (via r/singularity, 180 and 242 upvotes across two threads)
Stack layer / Contrast
Cactus Needle 3 is a 121M-parameter tool-calling model that ships in 8-29MB slices and refuses to chat
Cactus Compute / Hugging Face (via r/LocalLLaMA, 183 upvotes)
Stack layer / Threat pattern
A Fake Security-Product Story in an Unexecuted Binary Section Flipped 30 of 35 Malware Verdicts
arXiv 2609.19722
Stack layer / Contrast
MiniMax open-sources its terminal coding agent under MIT with bring-your-own-model support
GitHub / MiniMax-AI (via r/LocalLLaMA, 125 upvotes)