Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-03 · source-backed
GitHub published four advisories against omnigent-ai/omnigent v0.1.0, the meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h at CVSS 9.0 lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{id}/agent and attach a stdio MCP server that every future session then launches. GHSA-756x (8.8) reaches runner RCE through a bundle tool pointed at subprocess.check_output. GHSA-p8rw (8.8) takes os_env.cwd verbatim for arbitrary host filesystem access. GHSA-7mqg (7.1) is a fail-open shell parser: an unrecognized command yields None, which the evaluator treats as allow. All four were reported by Aeon, an autonomous security agent, which is the second data point this week on agents finding bugs the vendors' own scans missed.
Each link below shares sources, entities, or timing with this story.
QM went up under MIT license. Created July 29. As of the GitHub API check: 8,420 stars, 887 forks. Five days. YC uses it internally across accounting, legal, events, and engineering, including to build QM itself. Every employee and every Slack room gets its own scoped memory,...
1. Use claude agents --json to build session dashboards. Claude Code v2.1.145 outputs all live agent sessions as structured JSON with status, model, elapsed time, and parent relationships. Pipe it into a tmux status bar widget or session picker script for switching between bac...
A GitHub repo cataloging Claude Code tips doesn't normally warrant a top story. But shanraisshan/claude-code-best-practice at 53.4K stars isn't a tips list anymore. It's the de facto reference for how an entire generation of developers is learning to work with AI coding agents...
Waishnav/devspace (4,247 stars, v1.0.8 August 25) runs a local Node server exposing read, edit, search and shell execution over MCP, reached through a reverse proxy tunnel like Cloudflare or ngrok, with password-gated owner approval per client. The pitch is turning ChatGPT int...
affaan-m/ECC (36.3k forks, MIT) bundles 67 agents, 284 skills, 94 legacy command shims, and "instincts", patterns learned from prior sessions with confidence scores that auto-recall when relevant, plus a .ecc/memory/ markdown vault that's explicitly cross-harness, so context s...
Anthropic invented a file convention. It's now shipping GA inside a competitor's product. Nobody wrote a spec, nobody held a standards meeting, it just happened. On July 29, GitHub made agent skills and MCP server support generally available in Copilot code review for all Pro,...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.