Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
GitHub scored the path-traversal bug 8.6 and named prompt injection as the likely delivery path.
Why now: The risk stays live for any browse-mcp install that hasn't upgraded past 0.8.2, since prompt injection is the advisory's stated way in.
A path-traversal bug in browse-mcp lets a hostile web page choose where an AI agent writes files on disk, per GitHub's security advisory. For an agent with file-system access, a hostile page could overwrite configuration files, plant scripts, or drop files anywhere the process's account can reach, well outside the download folder the tool is supposed to write to.
The flaw, cataloged as CVE-2026-55557 with a CVSS score of 8.6, traces to the browser_download tool. It writes a downloaded response body to join(save_dir, filename) without checking the caller-supplied save_dir. The state save and load tools take the same shortcut, honoring whatever path the caller hands them.
The advisory names indirect prompt injection as the realistic trigger. An agent reads a page loaded with hidden instructions, and the page tells the agent where to save its own output. No code execution required, just a path the server never validated.
Browse-mcp fixed the bug in version 0.8.2.
Each link below shares sources, entities, or timing with this story.
— Security researcher Ari Marzouk disclosed 30+ vulnerabilities (24 CVEs) affecting Cursor, GitHub Copilot, Windsurf, Zed, Kiro, Roo Code, Junie, and Cline. The devastating finding: every tested AI IDE is vulnerable because none accounts for autonomous LLM agent behavior in th...
A spec is a press release until someone who didn't write it implements it. GitHub made Agent Plugins 1.0 generally available on August 12 across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app on all plans. The spec, published August 6, was co-authored by AWS, Anysp...
Three separate Anthropic changes over about two weeks point the same direction, and none of them announced themselves as a strategy. Claude Code 2.1.238 added claude self-hosted-runner --defer-shutdown-max-min, which keeps serving attached sessions on SIGTERM, parks whatever's...
Headroom compresses tool outputs, logs, RAG chunks, and files before they ever reach the model. It deploys as a library, a proxy server, or an MCP server, and the benchmarks are blunt: 92% token reduction on code search (17,765 down to 1,408) and SRE debugging (65,694 down to...
Three separately-maintained projects now occupy the same layer. CodeBurn reads on-disk session files to price 41+ tools locally and flags waste like re-read files and unused MCP servers. caveman (98.9k stars) interposes a local proxy doing content-type-aware compression, JSON...
This one rearranged my week. An essay published August 4 walks through Databricks' independent benchmark of coding harnesses against its own multi-million-line codebase. Pi, a harness with four built-in tools and a system prompt under 1,000 tokens, paired with Opus 4.8 at xhig...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.