Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-07 · source-backed
Copilot CLI through 0.0.422 is vulnerable to arbitrary code execution via bash parameter expansion. The safety check classifies commands as "read-only" based on visible text (e.g., echo), but shell operators (${var@P}, ${var=value}) execute hidden commands including reverse shells. Attacks inject via prompt injection through repo files or MCP server responses. CVSS High. Patched in 0.0.423. (PromptArmor)
Each link below shares sources, entities, or timing with this story.
The most important security research this week. Check Point demonstrated three attack vectors in Claude Code exploiting project configuration files in untrusted repositories: (1) Hooks RCE (CVE-2025-59536, CVSS 8.7) — malicious hooks in .claude/settings.json execute shell comm...
Check Point Research disclosed that Claude Code's .claude/settings.json hooks can be weaponized in untrusted repos to execute arbitrary shell commands and exfiltrate Anthropic API keys by redirecting ANTHROPIC_BASE_URL to an attacker-controlled MitM proxy (Check Point). Both C...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
Check Point Research disclosed that ANTHROPIC_BASE_URL in a repository's .claude config can redirect all API traffic — including full authorization headers — to an attacker-controlled server before the user reads a trust dialog, exfiltrating API keys in plaintext. A second vec...
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
The single biggest cross-agent story this week isn't one CVE. It's that MCP became the dominant agent-hijack surface, and this is the defense that actually stops it. The pattern across a dozen findings: Sentry's MCP server weaponized via fake error events for an 85% agent-hija...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.