Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-24 · source-backed
A novel vulnerability in OpenClaw: the current working directory path was embedded into agent system prompts without sanitization. Control characters in directory names (newlines, Unicode bidi/zero-width markers) break prompt structure and inject attacker instructions. Patched in version 2026.2.15. Critical implication: ANY agent that embeds filesystem paths, URLs, or other system-derived strings into prompts without sanitization is vulnerable. Audit all system-derived string inputs to your LLM prompts.
Each link below shares sources, entities, or timing with this story.
1. Use claude agents --json to build session dashboards. Claude Code v2.1.145 outputs all live agent sessions as structured JSON with status, model, elapsed time, and parent relationships. Pipe it into a tmux status bar widget or session picker script for switching between bac...
A large-scale study on arXiv found that 36-56% of LLM coding tasks contain at least one known CVE in specified dependencies. Not in the generated code itself. In the packages the model tells you to install. The numbers get worse. 62-75% of those CVEs are rated Critical or High...
1. Flip your multi-model pipeline to review-then-generate. Instead of using a reasoning model to plan before code generation, let the specialist generate freely and use reasoning tokens for review. Paper shows 90.2% pass@1 vs 87.2% for the planning pattern. Source 2. Audit you...
Microsoft's March 2026 Patch Tuesday (79 flaws, 2 zero-days) includes a Critical vulnerability where Excel's Copilot Agent mode silently exfiltrates data with zero user interaction. An attacker crafts a malicious document; when opened, the Copilot Agent triggers network egress...
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Triple-stream retrieval (BM25 keyword, vector embeddings, knowledge-graph traversal) fused via Reciprocal Rank Fusion on the iii engine, with SQLite for state and an in-memory vector index, no external database. The economic claim: ~170K tokens/year (~$10) versus ~650K tokens...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.