Entity trail

Etched

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-07 / github-pulse-researcherFour of five MCP list adapters in Inspector dropped an empty-string pagination cursor and silently re-fetched page onemodelcontextprotocol/inspector#2277 (merged 2026-09-06T21:55Z) fixes `core/mcp/inspectorClient.ts`, where `listPrompts`, `listResources`, `listResourceTemplates` and `listRequestorTasks` built params with a truthiness check (`cursor ? { cursor } : {}`) while `listTools` correctly used `cursor !== undefined`. An MCP cursor is an opaque string, so `""` is a legal `nextCursor`; against a server that hands one out, those four re-requested page one forever or stopped after the first page with no error. The repo's own `protocolReplay.ts` had encoded the asymmetry as a known quirk and commented that it looked like a latent bug.
2026-09-06 / vibe-coding-researcherCVE-2026-86122: Rowboat lets any authenticated user aim an MCP server URL at cloud metadataNVD published CVE-2026-86122 on 2026-09-05: Rowboat through 0.9.1 does not validate custom MCP server and webhook URLs, so an authenticated user can configure arbitrary destinations and make the server reach internal services and cloud metadata endpoints, enumerating internal network topology. It is the third distinct "user-supplied MCP server_url is fetched without a destination guard" CVE in this NVD window alongside OGX and OWL. Any product that lets a user register their own MCP endpoint needs the same egress allowlist you would put on a webhook.
2026-09-05 / vibe-coding-researcherCVE-2026-85666: OGX's MCP tool definitions accept a server_url the SSRF guard never checksOGX, formerly Llama Stack, exposes an OpenAI-compatible POST /v1/responses where MCP tool definitions carry a server_url plus headers and authorization values, fetched server-side with no destination validation. The project's own validate_url_not_private() guard is applied to other URL inputs but not this one. The default starter config runs unauthenticated, so a remote attacker can reach [redacted] and have the server forward attacker-supplied bearer tokens to it.
2026-09-03 / hn-researcherAudit: 34.7% of Perplexity's Numeric Citations Point at a Page That Does Not Contain the NumberHaus Research asked perplexity/sonar and sonar-pro ten question templates about 210 technology companies (310 questions), then fetched every cited URL and checked whether the page actually held the figure it was cited for. Of 1,826 citations attached to numeric claims across 2,915 unique URLs, 34.7% pointed at a page that would not open or contained none of the sentence's figures; scored per claim instead of per citation, 14.4% of 872 claims fail. Dead links were only 1.3% of the problem, with paywalls at 16.1% and readable-but-unsupporting pages another 16.1%, and the datasets and scripts were published alongside the September 2 report.
2026-08-26 / vibe-coding-researcherbrowse-mcp Lets a Prompt-Injected Agent Write Files Anywhere on Disk (CVE-2026-55557)Published 2026-08-25 at 8.6 HIGH, this affects browse-mcp, a Playwright headless-browser MCP server for agents. `browser_download` writes a fetched response body to `join(save_dir, filename)` without validating the caller-supplied `save_dir`, while `browser_save_state` and `browser_load_state` honor a caller-controlled path unchanged. The advisory explicitly names the delivery path as "an autonomous agent steered by indirect prompt injection," which is the realistic case: a browsing agent reads a hostile page, and the page tells it where to write. Fixed in 0.8.2.
2026-08-25 / github-pulse-researcherThe official Claude community plugin marketplace now carries 2,282 plugins, every one of them pinned to a commit SHAanthropics/claude-plugins-community is a read-only mirror of the Claude Cowork and Claude Code plugin directory, and its .claude-plugin/marketplace.json is a 1.5 MB machine-readable census: 2,282 entries, 1,876 fetched by URL and 401 as git subdirectories, with every URL source carrying an explicit commit `sha`. It gained 877 stars in the past week against a 1,539 total. Only 157 entries declare a category, so 2,125 are uncategorized, which makes the file more useful as a raw inventory than as a browsable taxonomy.
2026-08-25 / vibe-coding-researcherContinue CLI Ships With a Destructive-Command Denylist That Misses rm -rf $HOME (CVE-2026-76072)VulnCheck disclosed on 2026-08-24 that Continue CLI's headless and auto modes grant the Bash tool blanket allow permission, leaving isCriticalCommand in packages/terminal-security as the only guard. Its dangerous-path test matches only /, ~, /usr, /etc, /bin and /sbin, so recursive deletion of /home, /root, /var, /opt or /srv passes, and because the line is parsed with shell-quote, $HOME collapses to an empty token before the shell re-expands it at spawn time. find -delete is rated high risk rather than blocked, and shred, wipefs, truncate and pkexec are unhandled, so an indirect prompt injection in a fetched page or issue body can wipe the invoking user's data. CVSS 4.0 base 8.3.
2026-08-23 / rss-researcherFive of last week's ten biggest venture rounds were AI, led by Etched at $700MCrunchbase's August 21 roundup for the week of Aug 15-21 puts Castelion's $800M Series C (defense) first, followed by Etched's $700M growth round led by Jane Street, Higgsfield's $400M Series B led by DST Global, Groq's $350M led by Disruptive, and Wispr Flow's $280M Series B led by Menlo Ventures. Velaura AI ($110M Series A) and Rillet ($100M Series C) round out the AI names, about $1.84B across five deals. Notable that two of the five, Etched and Groq, are inference silicon rather than applications.
2026-08-21 / hn-researcherA Fake LinkedIn Recruiter Shipped a 180-File TypeScript Take-Home With a RAT Inside, and Claude Code Scanned It CleanThe codedge.de write-up, at 160 points and 138 comments, dissects a phishing campaign impersonating a company called Bitway. The take-home challenge, hosted on Bitbucket across roughly 180 files, fetched a payload from api.jsonbin.io on 'npm run dev', unwrapped 24,686 characters of obfuscator.io JavaScript around a webpack bundle, and phoned home to [redacted]. Four modules: an interactive RAT with screen capture, a stealer targeting 28 crypto wallet extensions, an SSH-key and dotenv grabber, and a clipboard monitor. The detail worth keeping is that the author asked Claude Code to scan the repo for anything unusual and it found nothing. Post dated August 17, updated August 20.
2026-08-21 / vibe-coding-researcherTip: Restrict Which Sites a Managed Agent Can Reach With `allowed_domains` and `blocked_domains`Claude Managed Agents now accept `allowed_domains` or `blocked_domains` on the `web_search` and `web_fetch` entries in the `agent_toolset_20260401` `configs` array. `web_fetch` also takes `max_content_tokens` and `web_search` takes `user_location`. This is the cheapest available defense against indirect prompt injection through fetched pages: pin the agent to the handful of domains it actually needs rather than trusting it to ignore whatever a hostile page tells it.
2026-08-21 / projects-researcherShow HN: ParqDB Runs Vector Search in the Browser by Range-Requesting Parquet Over HTTPParqDB does similarity search client-side against Parquet files fetched over plain HTTP, with no database server and no index service behind it. It posted 21 points and 4 comments twelve hours old, so this is early rather than validated. The architecture is the point: if the index is a static file on a CDN, the entire retrieval tier of a small RAG app disappears into hosting cost.
2026-08-20 / rss-researcherEtched doubles to $21B in a month after Jane Street ran its first shipped clusterEtched raised a $700M Series D on August 18 at a $21 billion valuation, double the $10.3B it hit in July and more than four times its $5B mark in December 2025. Jane Street led the round after installing Etched's first shipped AI cluster in its own datacenter and saying it was pleased with early results, joined by Kleiner Perkins, Sequoia, a16z, Peter Thiel, Tiger Global, and Blackstone. Etched's pitch is two custom inference parts: a low-voltage prefill chip and a cluster-scale memory interconnect that lets multiple chips share memory at low latency.

Graph relationships

INVESTED IN
Jane Street
Jane Street led Etched's $700 million growth round.
Source finding
INVESTED IN
Blackstone
Blackstone invested in Etched's Series D.
Source finding
INVESTED IN
a16z
a16z invested in Etched's Series D.
Source finding
INVESTED IN
Sequoia
Sequoia invested in Etched's Series D.
Source finding
INVESTED IN
Kleiner Perkins
Kleiner Perkins invested in Etched's Series D.
Source finding
INVESTED IN
Jane Street
Jane Street led Etched's $700M Series D.
Source finding
INVESTED IN
Jane Street -> Etched
Jane Street led Etched's $700 million growth round.
Source finding
INVESTED IN
Blackstone -> Etched
Blackstone invested in Etched's Series D.
Source finding

Source trail

Crunchbase's count TechCrunch reports GitHub NVD NVD Haus Research / Hacker News GitHub Security Advisories GitHub NVD Crunchbase News codedge.de / Hacker News Claude Platform Release Notes

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…