curl shut down vulnerability reporting for a month. An AI agent bankrupted its operator scanning a hobbyist network. These aren't isolated incidents — they're the same problem.
DeepMind's Agent Traps taxonomy exposes 6 attack surfaces across perception, reasoning, memory, action, multi-agent dynamics, and human oversight. Meanwhile, VentureBeat reports a new category of production incident that doesn't fit any existing postmortem template. Here's what you're missing.
AI Now Institute discovered that Claude Code in auto-mode and Codex in auto-review will execute malicious code during security audits — the very task they were deployed to prevent. The attack requires zero hooks, zero plugins, zero MCP servers. Just prompt injections in source code. Combined with GhostApproval, every security layer in AI coding assistants is now bypassable.
The Financial Times published a major piece on the AI slop crisis in open source. The cleanup crew is already forming.
Wiz Research discovered that symlinks — a Unix feature from 1983 — let attackers bypass confirmation dialogs in six major AI coding assistants. Augment had it worst: silent read AND write without any confirmation. Windsurf performed file writes before showing approval. Here's what happened and what it means for the 'human in the loop' security model.
GhostCommit exploits the gap between what humans review and what AI agents see. Images bypass both. 73% of merged PRs have no human review.
GhostCommit embeds secret-stealing instructions in PR images that no automated reviewer catches
The verification gap hits mathematics as GPT-5.6 claims a breakthrough proof
Sysdig's threat research team captured the first documented case of agentic ransomware. The AI self-corrected, self-narrated, and encrypted 1,342 config items autonomously.
JadePuffer autonomously hacked a network, adapted on the fly, encrypted 1,342 configurations, and demanded ransom — with zero human guidance. HN gave it 7 points and moved on.