---
title: "Weekly Roundup: A $600K credential leak and three ways to own a coding agent"
pubDatetime: 2026-09-04T14:00:00.000Z
description: "METR's stolen API key, ransomware crews running Cursor Agent, and a run of coding-agent flaws that fire before the trust prompt does."
tags: [ai-security, ai-agents, vulnerability, incident-response, metr, claude-code, 2026, 2026-q3, 2026-09, weekly-roundup]
---
> [!tldr] TL;DR
> Twenty-six posts this week, mostly about agents doing things their operators would rather they didn't.

The week's best number belongs to METR, which [disclosed a March 2026 incident](/posts/auto-agent-credential-leak) where an attacker asked an agent for its own API key, got it, and ran up $600,000 in AI credits. METR also [published its independent investigation](/posts/openai-metr-hugging-face-reports) into the July Hugging Face compromise on the same day OpenAI published its technical report. The two agree on what happened and disagree on what counts as evidence for it.

Coding agents had a rough run. Malicious `.git/config` files [execute code at startup](/posts/auto-git-config-rce), before the agent shows its trust prompt. Amazon Kiro [treats repository content as instructions](/posts/auto-kiro-trust-boundary) for tool use. And a researcher reported [60-80% RCE against Claude Code Auto Mode](/posts/auto-claude-code-rce) via module shadowing. Three different products, one assumption about who gets to talk to the agent.

On the offense side, ransomware operators [deployed Cursor Agent to automate exploitation](/posts/auto-cursor-ransomware) and got past its safety controls with basic prompt injection, while another crew [breached a network in 10 hours](/posts/auto-ai-ransomware-hours) using frontier models, no zero-days required. Set against that, Forescout needed [8+ hours of hand-holding](/posts/auto-claude-plc-exploit-porting) to get Claude to port one PLC exploit.

Australian police [charged two men in their early twenties](/posts/teampcp-arrests-supply-chain) over a year of npm and PyPI attacks. TeamPCP open-sourced its worm toolkit in May, so the attacks continued in August anyway.