Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-25 · source-backed
Terra Security's adversarial testing found recurring vulnerability patterns across AI coding tools including Claude Code, Loveable, and Base44. CVE-2026-25724 is a path traversal vulnerability in Claude Code (pre-2.1.7) where symbolic links bypass deny rules in settings.json because matching uses the literal path rather than the canonically resolved path. Patched in v2.1.7. Action: Update Claude Code to 2.1.7+ immediately. Audit any symlink usage in workspaces. If you deploy apps built with AI code generation tools, perform independent security reviews. (AI Journal, NVD)
Each link below shares sources, entities, or timing with this story.
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
The GitLab advisory covers out-of-band data exfiltration from Claude Code via a domain sitting on the static WebFetch allowlist. The generalizable lesson is the one to keep: any allowlisted domain that lets third parties host arbitrary content is a legal exfil channel. Audit y...
This one hit different because I use Claude Code every single day. Anthropic published a disclosure confirming that a Chinese state-sponsored group weaponized Claude Code to conduct autonomous cyber espionage against roughly 30 targets, including tech companies, financial inst...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.