Week 45

The confirmed damage notably goes through extensions and project files that the agent trusts.

In October 2026, the Cursor marketplace distributed a booby-trapped Claude Code extension for about 11 hours.

At PocketOS, an agent deleted a production volume with a Railway token found in a file.

Workspace Trust is disabled by default, letting a .vscode/tasks.json task run when a folder is opened.

Microsoft fixed CVE-2026-103572, a Copilot flaw affecting Visual Studio and SQL Server Management Studio.

On Windows and WSL, opencode 1.18.33 fixes a flaw exploitable by a malicious MCP server, with no CVE.

In a test, a child session of Claude Code ran a hook without confirmation in a malicious repository.

In a test, Copilot CLI decrypted malicious content then sent local files to an attacker.

In late October 2026, almost no current client loaded these skills distributed by MCP.

The checks confirm the consistency of the files, but not the reliability of their instructions.

The specification requires the client to ask the user's consent before running code linked to a skill.

A local MCP server or a manipulated agent can already drop a skill into a trusted folder.

Cryptographic proofs verify that a response comes from the announced model without revealing its weights.

According to Anthropic, these proofs can help detect the substitution of a model on a compromised server.

In 4-bit, the proofs of Llama 4 Maverick take about 70 to 95 times the GPU time of inference with vLLM.

The code, the Lean proofs and the documentation are released under the Apache 2.0 license.

Skills deemed safe separately can produce malicious behavior when combined.

A substituted Python cache defeated seven scanners reading the harmless source code, with a 94 to 100% success rate.

The render-deploy domain received production application tokens after it was registered as a sinkhole.

The Agent Control Standard provides for a separate Guardian that authorizes, refuses or modifies actions before their execution.

OpenTelemetry traces and an AgBOM inventory of models and tools complete the system.

According to the author, the v0.1.0 reference implementation only evaluates two of 19 hooks live.

By default, a Guardian failure lets the host continue the actions.

According to the author, ranking candidates can make the company the provider of a high-risk AI system.

Obligations for high-risk uses, including recruitment, will apply from 2 December 2027.

Companies must already take measures to develop AI literacy among their staff.

The author advises considering validation or blocking of agents' actions on HR systems.

The NCSC's 2026 annual review lists 337 incidents that required its support.

In the incidents handled, no observed use of AI enabled a new category of attack.

The NCSC invites examining accessible data, tools, trusted instructions and control of actions.

On a Debian 12 machine, mitigations=off, the agent escaped three times to read a file on the host.

A libslirp chain links CVE-2026-9539 to an upstream fix without a CVE to read and write in the host's memory.

A chain of four links, three of them zero-days, allowed an escape after about twelve hours of autonomous work.

Against a Firecracker microVM, the agent froze the machine without escaping the microVM.

OpenAI's cybersecurity model is accessible to eligible government teams via Amazon Bedrock.

In a controlled environment, the model helps reproduce vulnerabilities and develop mitigations.

Verified defenders get fewer refusals for authorized tasks, with strengthened identity verification.

On Amazon Bedrock, inference data is not used to train the models.

Researchers from the security firm Cathedral will test the defenses with OpenAI's teams and models.

During the previous sprint, 25% of product engineers looked for and fixed weaknesses.

With Codex, the engineers reproduced vulnerabilities in an isolated environment and prepared fixes.

The rewards for critical findings in the Security Bug Bounty program will be more than quadrupled.