Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-09-05 · source-backed
v0.60.0-nightly.20260905 adds consent prompts on extension environment changes with sanitization of runtime-altering variables (#28863), tighter workspace path boundary checks and symlink resolution in command safety and file discovery (#29170), and strict permission and ownership checks on system-wide config paths (#29115). That's the second consecutive nightly whose entire content is security work, after the September 4 build removed a hardcoded Google API key from chrome-devtools-mcp (GitHub).
Each link below shares sources, entities, or timing with this story.
RFC 9207 issuer identification enforcement in the MCP OAuth flow, isolation of the temporary directory for the macOS Seatbelt sandbox, path resolution and boundary validation hardening in the extension loader, and sanitization of a hardcoded Google CrUX API key out of chrome-d...
The antigravity-awesome-skills repository hit 36,145 GitHub stars with a catalog of 1,400+ installable SKILL.md playbooks that work across Claude Code, Cursor, Codex CLI, Gemini CLI, Kiro, OpenCode, and GitHub Copilot. One command: npx antigravity-awesome-skills --claude. That...
A single PR title. A hidden HTML comment in an issue body. No jailbreak, no social engineering, no user interaction required. Your credentials get exfiltrated through GitHub's own infrastructure before you ever see the notification. Security researcher Aonan Guan (Wyze Labs) a...
Google rejected the link on the grounds that the receiving organization is not tax-exempt, even after the project supplied Open Source Collective's IRS 501(c)(6) determination letter (GitHub issue). Google's stated policy permits donations to "a validated tax-exempt organizati...
Task executor migration to Go, a fifth batch of agent PRs ported, Go rewrites of the Tavily, Google search, Google Scholar, DuckDuckGo and Wikipedia canvas components, plus GCS support and an admin server in Go. GitHub GitHub now labels the 88,966-star repo as Go, which confir...
chrome-devtools-mcp isn't another community MCP server with 200 stars and a README that doesn't match the code. It's Google's Chrome DevTools team shipping an official MCP server that gives any coding agent (Claude Code, Gemini CLI, Codex, Cursor) full access to Chrome DevTool...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.