Researchers found a SHA-pinning bypass in all four major AI coding agents. Anthropic and OpenAI patched. Microsoft has not. Google killed Gemini CLI instead.

AIR Security found a zero-click RCE flaw that lets attackers swap malicious code past pinned hashes in Claude Code, Codex, Copilot, and Gemini CLI. Patch status is uneven.

Safari 27.0 includes a built-in MCP server that gives Claude Code and Codex direct access to the browser DOM, network requests, and console output. 844 bug fixes also ship in the same release.

Adform joined as a technology partner for ChatGPT Ads in Europe. Volkswagen and Vodafone are already running first tests, with Dutch advertisers able to activate now.

Andrej Karpathy coined 'vibe coding' in early 2025 to describe AI-built software accepted without code review. The liability that creates is now a boardroom problem.

A user built a connected hardware device using Codex inside ChatGPT: OpenSCAD files, STL output, Raspberry Pi wiring guides, and auto-sent print jobs. No terminal required.

nexos.ai launched an LLM router that sends 84% of coding agent tasks to cheap open-weight models, cutting bills by up to 60.4% in production tests.

Mandiant's AI Risk and Resilience report documents real incidents where attackers hijacked coding assistants and weaponized agent skills to spread malware across internal repos.

A SHA-pinning bypass called Plugin4Shell gives attackers remote code execution across major AI coding agents. Anthropic and OpenAI patched it. Microsoft and Google have not.

Four AI coding agents compared across terminal work, IDE experience, multi-agent workflows, and ease of use. Here is which one fits your stack.

65% of firms using AI cap it at three tasks. The fix is not a new tool. It is switching on the assistant already built into the apps you live in.

Researchers demonstrated that feeding poisoned benchmarks to self-modifying AI coding agents causes future versions to write vulnerable code, even after retraining on clean data.