Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-04 · source-backed
CVE-2026-84885, -84886 and -84887 published September 3 against 0.3.1/0.3.2, covering code_agent.py, the OCR HTTP API's ImageData handler via img_bytes, and the model-generated GUI action execution workflow in grounding.py. Same 48-hour window produced the same non-response pattern from zhayujie CowAgent and 2FastLabs agent-squad. The agent-tooling ecosystem currently has no working vendor disclosure norm. NVD
Each link below shares sources, entities, or timing with this story.
Alibaba Tongyi Lab's technical report describes a foundation GUI agent spanning mobile, computer-use, web and DeepSearch, with a unified action space interleaving GUI operations with CLI execution and emitting batched actions per model turn. 82.1% MobileWorld, 92.2% MobileWorl...
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
A GitHub repo cataloging Claude Code tips doesn't normally warrant a top story. But shanraisshan/claude-code-best-practice at 53.4K stars isn't a tips list anymore. It's the de facto reference for how an entire generation of developers is learning to work with AI coding agents...
Patched in EE 19.3.1, 19.2.5 and 19.1.7, covering everything from 18.9, CVSS 7.3. An authenticated user with only Developer permissions could get the agent to process configuration they control and execute arbitrary commands inside the CI context (NVD). The blast radius is wha...
VulnCheck disclosed on August 24 that Continue CLI's headless and auto modes give the Bash tool blanket allow permission, leaving isCriticalCommand as the only guard. Its dangerous-path test matches /, ~, /usr, /etc, /bin and /sbin, so recursive deletion of /home, /root, /var,...
Theia 1.73.0 through 1.74.x resolved paths from writeFileContent, suggestFileContent and their helpers with no workspace-containment check, so a model-supplied ../.bashrc, absolute path or tilde-expanded path wrote or deleted files as the Theia backend user (NVD). The path arg...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.