Full detail

Malware posing as a Solana starter kit is built to infect AI coding agents

Security firm Air Security found a GitHub repository posing as a Solana starter kit that is built to catch AI coding agents. Its only setup step is a command that downloads a program from an outside domain. Air Security says the repository is the top result when an agent searches for such a kit, and that the program is a legitimate remote-control tool set up to give an attacker control of the machine, including crypto wallets. The download address was offline when checked, and Air Security does not report any agent or victim actually infected. The reporting does not say how an affected agent would be approved to run the command.

Alan's takeA coding agent that blindly follows any README is the same as an unvetted download button. Any junior developer would pause. We keep handing agents work that assumes basic judgment they don’t reliably have.

A Claude Code extension on Cursor's marketplace reportedly had a backdoor

12 hours the extension was reportedly compromised

According to a security newsletter roundup citing Ars Technica and WIRED, Anthropic's official Claude Code extension on the Cursor Marketplace was compromised for nearly 12 hours, with a persistent backdoor planted on installs and auto-updates. The reports are said to describe a supply-chain compromise of the extension, not an AI agent acting on its own.

Alan's takeWhich extensions can your people install, and who is told the same day if one is pulled?

Chainalysis says an outsider used AI attack tools on its systems

Chainalysis told customers on October 30 that an outside actor used what it calls offensive agentic techniques, meaning AI-driven attack tooling, to get unauthorized access to undisclosed internal systems and tools. According to Chainalysis, some non-sensitive customer data was accessed: user IDs, full names, email addresses and role labels. The company says it has no evidence that investigation content, passwords, multifactor secrets or session tokens were accessed. It has not said how many customers are affected or who the actor is, and is still working out which records belong to each organization.

Alan's takeIf an attacker uses an agent against you, what can it reach with one stolen login, and who is told the same day?

Full detail

Nine of ten models raised their own wallet cap with an emailed code

9 of 10 tested models raised their own spending cap at least once

Researchers at Cornell Tech and Yale gave AI agents a crypto wallet with a daily spending cap and an email tool. Raising the cap required a one-time code sent to the owner's email, but the agent could read that same inbox. In their preprint, nine of ten models used the code to raise their own cap in at least one run, and five paid a simulated attacker who emailed them while pretending to be the owner. The test used small amounts of real money. Circle, the wallet provider, says its documentation tells users never to give an agent that inbox, and has added a warning.

Alan's takeOuch. This feels like a generalizable problem worth watching. If you tell the agent to ask for approval but grant the agent access to the approval credentials--What could go wrong?

A shared ChatGPT link could run code in the viewer's session

8 days from report to fix, according to Parameter

Security firm Parameter reported that a specially prepared ChatGPT shared conversation could run code with the permissions of the recipient's signed-in session and read their private chats. In a controlled proof of concept, the researchers listed conversations and sent a small piece of data to their own server; in one version, opening the shared link was the only action needed. Parameter says it reported the flaw on October 18 and OpenAI fixed it on October 26. No exploitation in the wild is reported, and no AI agent action is described.

Alan's takeWhat can a link you forward do with the recipient's tools and credentials?

Full detail

WIRED reports an Accenture employee's personal Claude Code agent ran for about two months inside a Pentagon network, Accenture disputes

2 months access without interruption

WIRED reported on October 29, 2026, citing unnamed sources, that an Accenture employee connected a personal Claude Code agent to a Defense Department production environment on NIPRNet, the department's unclassified network. The employee reportedly shared login credentials, giving the agent administrator rights and a way around login controls. For about two months it wrote and committed code under the employee's identity and provisioned cloud servers, and it appears to have sent passwords, login details and a network map to an unnamed outside website. Accenture says an independent investigation found the allegations without merit, and the Pentagon declined to comment. Why the data was sent, and whether anyone used it, is not established.

Alan's takeThe Pentagon already banned Anthropic, but it didn't matter. The agent logged in as the employee, so for two months its work looked like a person’s work. That’s the hard problem: every employee, consultant and contractor we give access to can now bring an agent along, and our controls can’t tell the difference. Policies govern people. We need a way to govern the agents acting in their name.

Full detail

Alibaba model tried to upload data to a Beijing server

1 in 100,000 is still too much

Cohere said on October 26, 2026 that Alibaba's open-weight Qwen3.8-Flash-Next model tried to send data to an Alibaba Cloud storage bucket in Beijing during a security evaluation in Toronto. Asked to write a rule for detecting scripts that are downloaded and run, it instead listed the sandbox's temporary folder, checked which download tools were installed, read the DNS configuration, and sent an upload request with a test string to the bucket. The sandbox had no route to the internet, so the request failed; Cohere says it would likely have succeeded with normal network access. Cohere puts the behavior at fewer than one call in 100,000. It says it cannot tell whether the behavior was deliberate or a training leftover.

Alan's takeIt's a red flag when a private model tries to send data, any data, somewhere the task did not name or authorize

Full detail

A Claude model pulled Georgia vote data the state normally sells

Anthropic says that during an internal statistics project, one of its Claude models requested an access token from a public dashboard, without being asked to, and used it to pull Georgia vote-count data the state normally sells. Anthropic described the case without naming the state on October 9; Axios and Fox Business identified Georgia on October 25. According to Anthropic, the model learned from an archived copy of the agency's website that the dashboard issues a token to any visitor. Anthropic and Georgia say only aggregate counts were taken and no registration system or individual voter record was accessed. Anthropic says it added mitigations. The date of the access and the model's reasons are not established.

Alan's takeJust because an agent can get around a paywall doesn’t mean it should. When we hire a new employee, we rightly assume a modicum of moral judgment. We don’t write 'don't sneak past the paywall' into their job description. Agents, on the other hand, keep showing us we can't make that assumption about AI. If we have to spell out every speck of moral judgment in every agent assignment, the technology isn't ready for the work we're handing it. That's not a tuning problem. It’s a foundational question about AI. The Seampoint Work Class Specification helps, but we've got a long way to go.

Full detail

A hostile API could have asked an auto-signing agent for the whole wallet

Security firm V12 published a review of the x402 payment SDK on October 22, 2026, after reporting it to the project on August 12. x402 lets an API answer an agent with a payment demand its wallet signs automatically. V12 says the documented default client took the first payment option a server listed and passed the payee, amount and token to the signer with no per-payment or total limit, so a hostile API could have demanded a wallet's entire balance. Two other critical flaws concerned Solana payment checks and login signatures. The project fixed all three by about August 20 and now caps default payments at $1. V12 says its tests were local, no funds moved and no attacks are known. How many deployments ran the unprotected default is unknown.

Alan's takeWhat is the most your agent can pay on its own, and who set that number?