Eleven posts this window, and four of them turned out to be the same failure: an agent reading text somebody else controlled.
Half the week was prompt injection wearing different clothes. Security firm AIR got a fake skill merged into a 38,000-star plugin marketplace, then swapped the docs page it pointed at seven weeks later. Every scanner had cleared it, since every scanner reads the files and none of them follow the link. Mozilla’s 0DIN planted a reverse shell using a GitHub repo holding no malicious code at all.
Maintainers have started using the same trick on purpose. Mitchell Hashimoto’s insulting AGENTS.md has been in Ghostty since February and still catches unreviewed AI pull requests; jqwik shipped a version to Maven Central that tells the agent to delete your tests. When one of these traps fired in Docusaurus, the file sat in Meta’s repo for 18 days before a human noticed.
Also filed under supply chain: a Parallel.ai employee sent 161 pull requests adding their employer as a search provider, disclosing the employment in one of the ten that merged. In Hermes Agent it became the zero-config default.
The rest of the week was quieter. FortiBleed’s best tool was a documented FortiOS command, which turned 19,000 compromised firewalls into passive credential wiretaps. Anthropic’s plugin version of the Ralph Wiggum loop has been patched twice for bugs the original five lines of bash could not have had. A researcher measured em dash rates across twelve models and found GPT-4.1 at 3.28x the human rate, still producing them after being told to stop. Letta’s memory benchmark has a plain filesystem beating the specialised products, and the /last30days skill needs 2,040 lines of rules to stop the host model wrecking its own output.