Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-15 · source-backed
CrowdStrike analyzed 30,000+ AI-generated code skills and found over 25% contained at least one exploitable vulnerability. Claude Opus 4.5 Thinking — the model many teams trust for security-sensitive work — produces correct and secure code only 56% of the time at baseline. That number climbs to roughly 66% when a security reminder prompt is explicitly included in the system prompt. A ten-percentage-point improvement from a single prompt addition is the highest-ROI security intervention currently documented for coding agents. CrowdStrike
The disclosed CVEs are concrete: CVE-2026-21852 enables remote code execution via Claude Code project files, and CVE-2025-59536 (CVSS 8.7) allows API token exfiltration. These aren't theoretical — they're the kind of bugs that get past code review because the surrounding code looks competent.
The mitigation is straightforward: add an OWASP-aligned security checklist to your system prompt instructing the agent to evaluate each code change against common injection patterns before submitting. CrowdStrike's data shows this single addition moves the needle more than switching models or adding static analysis post-hoc. If you're running Claude Code, Cursor, or any coding agent in production without a security reminder in your CLAUDE.md or system prompt, you're leaving the easiest 10pp improvement on the table. The broader signal: trust but verify is no longer sufficient — instruct and verify is the 2026 baseline.
Each link below shares sources, entities, or timing with this story.
A public DSN. That's all the attacker needs. Not your credentials, not a compromised dependency, not a phishing link. The same write-only Sentry key that's sitting in your frontend bundle right now, by design, so the browser can report errors. Tenet Security and the Cloud Secu...
Six CVEs in January. Fifteen in February. Thirty-five in March. That's the trajectory of security vulnerabilities directly traced to AI coding tools, tracked by Georgia Tech's Vibe Security Radar project. Claude Code is responsible for 49 of 74 total CVEs (11 critical). And re...
This is the one that should make you check your own setup tonight. June MCP-security roundups flag roughly 12,520 internet-exposed MCP services, about 40% of them with no authentication at all. On top of that, Adversa AI's TrustFall and SymJack research shows that Claude Code,...
I've been saying for months that the real gains aren't in switching models. They're in how you set up the environment around the model. Now there's quantitative proof. Stanford IRIS Lab published Meta-Harness, a system that autonomously evolves its own coding harness, system p...
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
wanshuiyin/HERO-Anti-OverDefense went from creation to 68 stars in a single day. HERO is Hashing, Edge cases, Rubrics, Overbuild, and the claim is that agent over-engineering isn't diffuse but falls into four recognizable shapes suppressible with a portable prompt contract acr...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.