Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-28 · source-backed
The executor inspected submitted source against a denied list of attribute names and calls, leaving the attribute-access escapes that always defeat that approach, with no authentication in front of it (NVD). Denylist sandboxing of Python loses reliably. The boundary has to be a process or a container.
Each link below shares sources, entities, or timing with this story.
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
Terra Security's adversarial testing found recurring vulnerability patterns across AI coding tools including Claude Code, Loveable, and Base44. CVE-2026-25724 is a path traversal vulnerability in Claude Code (pre-2.1.7) where symbolic links bypass deny rules in settings.json b...
NVD published this against kazuph/mcp-fetch through 1.6.3 on August 26. isSafeUrl reads the hostname from the parsed URL, which for yields the bracketed string, then tests it with net.isIP, which returns zero for a bracketed value. The entire private-address branch is skipped,...
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
github.com/RightNow-AI/openfang — First "Agent OS" in a single 32MB Rust binary. Autonomous scheduled agents with 7 pre-built "Hands" capability packages, 137K lines, 40 channel adapters, 16 security layers. 180ms cold start vs. 2-6s for Python frameworks. The "agent OS" categ...
Published to NVD and GitHub Security Advisories on August 27, this is a traversal in read_context in src/index.ts of bsmi021 mcp-file-context-server 1.0.0, remotely exploitable via the path argument, rated 5.5 MEDIUM (NVD). NVD's text notes the project was informed early throu...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.