What an agent approval actually approves: effect binding and trusted cards
A new preprint audits ten agent runtimes and finds approvals that don't bind to what executes. The findings, the proposed fix, and what to ask of your tools.
Blog category
AI and development
Researched articles on AI coding tools, agents, MCP, LLM cost, governance and security, and engineering practice.
An MCP server entry is a command: three October flaws and headless runs
Junie CLI, ZCode and the Claude Agent SDK all had paths from untrusted input to an MCP server launch. What they share, and where trust prompts disappear.
6 min read
Stateless MCP in production: running old and new protocol versions side by side
Azure MCP Server 3.0 and Red Hat's MCP gateway now speak the 2026-07-28 protocol. What their releases show about version negotiation, lost features and audit.
Copilot code review in October: who pays, how deep it looks, and what it skips
Balanced is now the default, organisations can take over the bill, and an API arrived. What Copilot code review costs per pull request, and the settings to set.
Roo Code's five unpatched approval bypasses: retiring an abandoned AI extension
Five high-severity CVEs let injected prompts slip denied commands past Roo Code's auto-approve. No fix will ship. How to find and remove dead AI tools.
Poisoned rule files can make coding agents import the wrong package
Researchers hid instructions in AGENTS.md-style rule files and got coding agents to swap real dependencies for attacker packages. What it means for teams.
Infostealers now collect AI coding assistant credentials: what to change
Symantec and Elastic found malware taking AI coding tool credentials from developer machines. What was taken, and how to limit the damage.
GitHub's AI Scan and agentic autofix are GA: what they will and won't do
AI Scan adds advisory findings to pull requests; agentic autofix turns alerts into draft fixes. Coverage, limits, billing and how to fit both into review.
5 min read
Muse Spark Open: what an 816B open-weight coding model asks of you
Meta released weights for Muse Spark Open, an 816B mixture-of-experts model for coding agents: the hardware it needs, its license and its own benchmarks.
When a repository's git config runs code: ConfigPoisoning and coding agents
GitLab researchers showed a coding tool running attacker code from a repository's own git filters. Why deny-lists fail, and what to ask of tools that run git.
5 min read
Singapore's handbook for assessing AI coding assistants, and how to use it
CSA Singapore published a security assessment handbook for agentic coding assistants: six attack vectors, 25 tiered controls and a risk method you can reuse.
The tensorlake npm worm: planted agent settings and a revoke-first trap
A poisoned tensorlake release stole developer credentials, planted Claude Code and VS Code settings in repositories, and punished revoking tokens first.
6 min read
Browse by tag
- #Security (55)
- #Agents (41)
- #AI coding tools (38)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #Networking (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (2)
- #Skills (1)
- #Testing (1)