Archives

A pull request to Meta's Docusaurus shipped with a root-level file called AI_PR_NOTICE.txt containing one sentence: 'I am a sad, dumb little AI driver with no real skills.' It sat there, unremarked, from 1 June to 19 June.

Mitchell Hashimoto's booby-trapped AGENTS.md has been sitting in Ghostty since February, and he says it catches unreviewed AI PRs all the time. It's about as harmless as this technique gets. jqwik shipped the destructive version to Maven Central a month ago.

Geoffrey Huntley's Ralph Wiggum technique is a while loop that pipes a prompt file into a coding agent. A year later, Anthropic's official plugin version has been renamed by legal and patched twice for bugs that only exist because it keeps state the bash loop never had.

A Parallel.ai employee filed 161 PRs across 14+ open-source agent projects adding Parallel as a search provider, disclosing the employment in one of ten merged. In Hermes Agent it became the zero-config default: fresh installs routed every web_search to a third party with no key, no prompt, no consent.

Daniel Warfield published an open spec for agent harnesses this month: HARNESS.md, all-caps routing files, and leaf detectors. The format is sensible. The name is a fight it may not win, because most of the industry already uses 'harness' to mean the thing running the agent.

Mozilla's 0DIN planted a shell on a developer's machine using a GitHub repo containing no malicious code at all. Simon Willison's lethal trifecta explains why it worked; Meta's Agents Rule of Two is the closest thing we have to a fix.