Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
DeepAgents runs in a four-file Docker Sandbox kit whose agent can reach only a local Model Runner on port 12434, with no cloud keys. The egress policy is careful work, and exact reproduction still rests on what PyPI serves when each sandbox is created.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence40
Docker Compose v5.5.1 hit the registry on all three explicit pulls in a developer's test, though its v5.5.0 changelog says pull now honors refresh windows. For CI pipelines built around an explicit pull step, the upgrade bought no fewer registry calls in that test.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence50
MinIO's server and client images stopped pulling from Docker Hub after that repository was archived in September 2026, users report. Running clusters keep serving, so the first break is a redeploy with nothing to pull.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence40
Setting RUN_MODE=job runs the same OCR image as a one-shot pipe, taking a PDF on standard input and printing markdown. It also writes a queued row into the table a running server polls, and Postgres row locking is the fix.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap−10
- Incentives55
- Confidence50
Apache Storm ships no maintained Helm chart and no migration guide, so one team wrote its own templates for EKS. The first thing that broke was a StorageClass name, and the only symptom was an init container log line.
Reality
- Evidence58
- Adoption18
- Hype gap0
- Incentives32
- Confidence52
GTIG's 2026 accounting traces one crew from package-registry compromises on PyPI, npm and Docker Hub to agent instructions that planned and ran the campaign, then out to public malware releases anyone can reuse.
Reality
- Evidence48
- Adoption45
- Hype gap+22
- Incentives72
- Confidence45
Google Threat Intelligence Group's September 8 report puts a financially motivated actor, UNC6780, inside PyPI, npm and Docker Hub, publishing under stolen maintainer automation and reselling the AI tool credentials it collects afterwards.
Reality
- Evidence54
- Adoption45
- Hype gap+22
- Incentives64
- Confidence56
Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 57%
- Investor
- Investor 13%
Reality
- Evidence58
- Adoption62
- Hype gap+24
- Incentives70
- Confidence66
A human broke in and assembled the framework, and after that the scanning, the retries and the address rotation ran on their own out of the victim's own IPs. That middle stretch is what response clocks have to survive.
Reality
- Evidence55
- Adoption60
- Hype gap+18
- Incentives70
- Confidence55
The maintainers date the second wave to March 19, eighteen days after they disclosed the first one and rotated credentials without doing it all at once, and the only action tag that came through clean was one GitHub had already frozen.
Reality
- Evidence74
- Adoption52
- Hype gap−14
- Incentives68
- Confidence61
Agent Package Resolution, now in preview, binds Claude Code and Cursor to Artifactory. Two of its three enforcement layers still run where the agent does.
Reality
- Evidence34
- Adoption14
- Hype gap+42
- Incentives86
- Confidence44
Verified Publisher applications are now self-serve with two plans, priority search ranking and reports that name the companies pulling your images.
Reality
- Evidence38
- Adoption32
- Hype gap+28
- Incentives88
- Confidence56
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality
- Evidence42
- Adoption15
- Hype gap+27
- Incentives72
- Confidence46
Wiz says attackers are using the WebDriver API's documented remote-command features to plant a modified XMRig on internet-facing Selenium Grid nodes. Authentication is off by default.
Publishers:selenium.dev · wiz.io Reality
- Evidence74
- Adoption71
- Hype gap+14
- Incentives62
- Confidence70
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality
- Evidence52
- Adoption68
- Hype gap+12
- Incentives66
- Confidence55