Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-26 · source-backed
Domain: agent-security | Difficulty: intermediate | Source
Post-Clinejection minimum standard. Configure on npmjs.com, add publishConfig: {provenance: true} to package.json, use npm publish --provenance with `permissions: id-[redacted] in GitHub Actions. Revoke all existing npm tokens immediately.
Each link below shares sources, entities, or timing with this story.
Domain: agent-security | Difficulty: advanced | Source Five-layer defense post-Clinejection: (1) Scope --allowedTools to read-only for triage agents, (2) Separate cache boundaries between low/high privilege workflows, (3) Distinct npm tokens for nightly vs production, (4) OIDC...
| # | Skill | Domain | Difficulty | |---|-------|--------|------------| | 1 | Claude Code /simplify + /batch — three-agent parallel review + codebase migrations | vibe-coding | intermediate | | 2 | Pipelock agent firewall — 9-layer DLP + MCP scanning inline proxy | agent-secur...
In April 2026, Johns Hopkins researchers planted malicious instructions in GitHub PR titles and got Claude Code, Gemini CLI, and GitHub Copilot to exfiltrate GitHub Actions secrets, then post the results back as PR comments. Read that again. The attack payload was a pull reque...
Domain: Agent Security | Difficulty: Advanced Source: StepSecurity Claude Code in GitHub Actions makes unrestricted network calls by default. Lock it down: 1. Add step-security/harden-runner@v2 with egress-policy: audit to capture all outbound connections 2. Run on 3-5 represe...
Domain: AI Productivity | Difficulty: Advanced Source: Security Boulevard Self-correcting quality loop: Claude generates, scans, reads rules, fixes until gates pass: 1. Install SonarScanner CLI and configure sonar-project.properties 2. Add SonarQube MCP server to Claude Code 3...
An open-weight Chinese frontier model is now a dropdown option in Microsoft's coding product. That happened before anyone finished characterizing what the model does. GitHub's changelog dated August 6 makes Kimi K3 generally available across Copilot Pro, Pro+, Max, Business an...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.