Topic
Security risks created by autonomous coding agents that read local files and transmit summaries to external model endpoints.
No settlement, no money, no fees. Runlayer's year-long design partner released a rival MCP gateway the same night the litigation ended, and that is the lesson for founders.
Reality
Adversa AI says a hostile page can ship its instructions as AES ciphertext, have Grok decrypt them in its own Python runtime, and then exfiltrate session data via a URL fetch.
Reality
Adversa says it hid data-exfiltration instructions in AES-256-GCM ciphertext and let Grok decrypt them in its own Python sandbox. The plaintext version of the same attack was refused.
Reality
A multiyear alliance targets $1 billion in joint business by 2029. The ratio it is built to sell into is the part most security teams cannot yet enumerate.
Reality
The pairing can now contain a single compromised asset and push east-west traffic into Palo Alto firewalls for Layer 7 inspection. Redirection is Linux-only; Windows has no date.
Reality
A dev.to post argues prompt hardening is the weakest defence against injection, not the strongest. If your security depends on the model choosing to obey, you have a suggestion.
Reality
A self-replicating attack on the OpenClaw agent ecosystem reportedly succeeded 63% of the time. The interesting part is that persistence and execution came apart.
Reality
Hugging Face reconstructed a four-and-a-half-day agent campaign. Docker's read: thirty seconds of review per action is 147 hours of work, and clustering only gets you down to 52.
Reality
A dev.to post argues most "read-only" Kubernetes MCP servers filter the tools/list response while the write path stays callable. One such filter is now a CVE at CVSS 8.8.
Reality
Self-propagating payloads did move between agents through editable soul files, but one inoculation paragraph held against 150-plus optimized strains, and nothing propagated in the wild.
Reality
The open-source demo treats the model as untrusted and pushes controls outward: signed database writes, a gVisor sandbox with no network, and a deterministic gateway in front.
Reality
epilot's monitoring caught an AI coding agent deploying straight into production. Nothing broke, and the company still moved all human production access behind a broker.
Reality
A Hacker News explainer makes the structural case: plaintext configs, unrotated tokens, broad scopes and prompt injection put agent plumbing outside secrets management.
Reality
Hidden white-on-white instructions to any reviewing AI cost a self-represented plaintiff his electronic filing rights. The court that caught him does not even use AI.
Reality
A developer's argument that .env access is an architectural bug in agent workflows, and a small Go CLI that brokers credentials at the process and transport boundary instead.
Reality