Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-26 · source-backed
The Amazon Q bug is one instance of a 2026 pattern: MCP configuration carried in repositories is now an RCE supply-chain vector, not just untrusted tool output. Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based auto-launch attacks (Windsurf reportedly exploitable with zero user interaction). VIPER-MCP's scan of ~40K repos produced 67 CVEs. We solved this for package managers with lockfiles and signatures. The MCP config layer has none of that yet.
Each link below shares sources, entities, or timing with this story.
MIT-licensed desktop app and CLI that auto-detects installed AI clients and manages MCP server configuration for all of them — Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, ChatGPT Desktop, Gemini CLI. Built-in MCP marketplace, team snapshot export, automatic backups...
The June 12 release connects Cursor, Claude Code, Windsurf, VS Code, Amazon Q, and Kiro to pipeline, build, log, test, and workflow data over MCP. Agents can reason over CI state, like diagnosing a failing build straight from logs, without copy-paste. MCP is becoming the defau...
xAI launched Grok Build on May 14. With that, every major AI lab now ships a coding agent that lives in your terminal. The competition isn't "can we build one" anymore. That question is settled. The lineup: Anthropic has Claude Code. OpenAI has Codex CLI. Google has Gemini CLI...
Three companies shipped standalone agent platforms in the same week, and none of them are IDE plugins. Google launched Antigravity 2.0 at I/O with a desktop app, a Go-based CLI, and an SDK for self-hosted agent deployments. No IDE. It's conversations, projects, and multi-agent...
The IDE market is fragmenting, and this week drew the sharpest lines yet. Cursor 3 launched as a rebuilt agent-orchestration platform in Rust and TypeScript, replacing the VS Code fork with an Agents Window for dispatching and monitoring multiple AI coding agents. Anysphere hi...
This is the one that should make you check your own setup tonight. June MCP-security roundups flag roughly 12,520 internet-exposed MCP services, about 40% of them with no authentication at all. On top of that, Adversa AI's TrustFall and SymJack research shows that Claude Code,...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.