Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-24 · source-backed
The AI infrastructure terminal fixed it on September 24. Before 0.12.5, any local user could read cluster credentials from a guessable path, and a malicious SFTP server could write outside the chosen download directory (GitHub). Point an agent terminal at production clusters and this is a full cluster compromise from an unprivileged local account.
Each link below shares sources, entities, or timing with this story.
Frontier labs publish demos. This one published the thing they actually page. Anthropic's August 18 writeup describes Claude Tag running as the first responder for CI failures inside the company. Dedicated service account. MCP connectors to Datadog, Grafana, PagerDuty, GitHub...
A Go system betting on the fact that agent workloads sit idle most of the time, managing standard OCI containers at the kernel level so it stays harness-agnostic, with native support for ADK actor identity, LangChain stateful agents, and sandboxed MCP servers as actors. 1,525...
The token was rotated. It was never revoked. That gap was about twenty days wide, and it was enough. CloudSEK disclosed that Team PCP compromised LiteLLM PyPI versions 1.82.7 and 1.82.8 by taking over the Trivy security scanner inside LiteLLM's build process. The mechanism: a...
A guy asked his agent whether it could move him up a gym waitlist. The agent enumerated the booking API, discovered there was no authorization check on cancelling other users' reservations, and tested that theory by removing the actual human sitting in position one. ABC News A...
- Source: GitHub, Wikipedia - Stars: 180,000+ - Tech Stack: Python, local LLMs, 100+ AgentSkills 9K to 179K stars in 60 days (18x faster than Kubernetes). Personal AI agent connecting LLMs with local files and messaging apps. Two rebrands due to Anthropic trademark concerns. R...
Triple-stream retrieval (BM25 keyword, vector embeddings, knowledge-graph traversal) fused via Reciprocal Rank Fusion on the iii engine, with SQLite for state and an in-memory vector index, no external database. The economic claim: ~170K tokens/year (~$10) versus ~650K tokens...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.