AgentsMicrosoft Patches First AI Coding Agent CVEs via Prompt InjectionKrebs on Security·high signalCVE-2026-21516/21523/21256: GitHub Copilot and VS Code RCE via prompt injection. First formal CVEs targeting AI coding agents in IDEs.SourceSource pageKrebs on Security↳ Follow the threadPolicy dependency / Stack layerPrismata Confines Cross-Site Prompt Injection by Treating Web Agents Like an XSS ProblemarXivPolicy dependency / Stack layerHalluSquatting weaponizes LLM hallucinations to push botnet malware into agentsThe Hacker NewsStack layer / Threat patternGitHub Ships CodeQL 2.26.0 With AI Prompt-Injection Detection for JavaScript/TypeScriptGitHub (CodeQL release notes)Policy dependency / Stack layerKastra Launches Policy Enforcement for Claude Code, Cursor, and CodexHacker NewsStack layer / ContrastOpenAI launches ChatGPT Work, an agentic workspace on GPT-5.6, with Sol/Luna/Terra model tiersInfoWorldStack layer / Threat patternSnyk's Evo Agentic Development Security Hit GA June 29 — an Enforcement Layer That Polices MCP Servers and Coding Agents at RuntimeSiliconANGLEStack layer / Threat patternCROSS-CATEGORY: Three Vendors in Three Unrelated Categories Shipped 'Agents That Supervise Other Agents' Inside Two WeeksVantaStack layer / Threat patternMitigating Taint-Style MCP Server Vulnerabilities Without Touching Server Code (SPELLSMITH)arXiv