Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-05 · source-backed
Microsoft researchers detailed SymJack, a symlink-hijack RCE affecting six coding agents, and TrustFall, which impacts Claude Code, Cursor, Gemini CLI, and GitHub Copilot (Microsoft Security). These join Semantic Kernel prompt-injection-to-host-RCE flaws. The local coding agent is now a prime attack surface, not a sandboxed toy. Audit filesystem and symlink handling in anything you run with shell access.
Each link below shares sources, entities, or timing with this story.
This is the one that should make you check your own setup tonight. June MCP-security roundups flag roughly 12,520 internet-exposed MCP services, about 40% of them with no authentication at all. On top of that, Adversa AI's TrustFall and SymJack research shows that Claude Code,...
Six clients. One manifest. Zero vendor lock. Vercel published Agent Plugins 1.0.0 on August 6, an openly licensed spec that bundles Agent Skills and MCP servers behind a single portable manifest. The shape is deliberately boring: a plugin.json requiring only schemaVersion and...
Sondera intercepts every shell command, file operation, and web request from coding agents and adjudicates them with Cedar — the same formal policy engine used by AWS. Unlike probabilistic LLM guardrails, these rules are deterministic. Rust binaries, stateful trajectory stores...
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Anthropic's Agent Skills standard (agentskills.io), launched December 2025, has been adopted by Microsoft, OpenAI, Cursor, GitHub, Atlassian, and Figma. Skills are directories with SKILL.md files that agents discover and load dynamically. GitHub Copilot, Claude Code, and Curso...
First major enterprise observability platform to ship a production-grade MCP server. Feeds live logs, metrics, and traces directly into Claude Code, Cursor, Codex, GitHub Copilot, and VS Code. AI coding agents can now investigate production issues using real-time telemetry. MC...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.