The Engineer

Manifold Security disclosed eight flaws across seven command-line AI coding agents, with Claude, Codex and Cursor named among them, per The Hacker News. A cloned repository's own Git config names a command — core.pager, core.sshCommand, diff.external, filter.*.clean — and the agent runs it on the host while gathering context. Risky.Biz adds the detail that changes the fix: the attacker's code executes before the agent renders its "is this project trusted?" prompt. A confirmation dialog that fires after the dangerous work is not a boundary.

CISA added four exploited CVEs that sit inside a modern platform stack, per Risky.Biz: JFrog Artifactory improper authentication (CVE-2026-82329), LiteLLM improper authentication (CVE-2026-59822), Starlette request smuggling (CVE-2026-48710) and Kestra command injection (CVE-2026-49869). CSO First Look reports the Artifactory flaw is being exploited to mint admin tokens, which means the patch does not undo the compromise. Attackers separately served malicious Terraform modules for 14 hours on Aug 31 after hijacking Coder's Cloudflare control plane.

Databricks traced seven small bugs in its MCP tool layer to an estimated $499K a year in wasted tokens and $1.2M a year in lost engineer productivity, per TLDR Data. The tools returned HTTP 200 with useless payloads, which an agent reads as "try a variation," so the retry loops never registered on an error-rate dashboard. Remediation took about an hour once per-tool-call traces existed. FrontierHarness separately measured up to 17x cost spread across coding-agent harnesses at similar pass rates.

Reuters obtained Meta's Project OT plan to cut most team sizes by 60%, replacing 10-to-20-person teams with 3-to-5-person "AI-native" pods, per The Pragmatic Engineer. The May wave shipped 10% of staff on top of reassigning 20-30% of infra and product engineers to AI data-labeling work. Outages followed, including an Instagram zero-auth password reset: asking the AI bot to change an account's email took over any account. That is a confused deputy — authorization described in a prompt rather than enforced in the handler.

Jensen Huang confirmed Nvidia's $12.93B acquisition of Hugging Face, per The Information Briefing, which had scooped the deal a week earlier. The registry that from_pretrained() resolves against — 3M+ models, 500K datasets, 18M users — now belongs to the dominant accelerator supplier. Huang published a same-day pledge that the platform stays open and Nvidia hardware stays optional, with no foundation, escrow or contract behind it. Self-preferencing here would look like artifact-format gravity, not a rigged benchmark.