Twenty-six posts this week, mostly about agents doing things their operators would rather they didn’t.
The week’s best number belongs to METR, which disclosed a March 2026 incident where an attacker asked an agent for its own API key, got it, and ran up $600,000 in AI credits. METR also published its independent investigation into the July Hugging Face compromise on the same day OpenAI published its technical report. The two agree on what happened and disagree on what counts as evidence for it.
Coding agents had a rough run. Malicious .git/config files execute code at startup, before the agent shows its trust prompt. Amazon Kiro treats repository content as instructions for tool use. And a researcher reported 60-80% RCE against Claude Code Auto Mode via module shadowing. Three different products, one assumption about who gets to talk to the agent.
On the offense side, ransomware operators deployed Cursor Agent to automate exploitation and got past its safety controls with basic prompt injection, while another crew breached a network in 10 hours using frontier models, no zero-days required. Set against that, Forescout needed 8+ hours of hand-holding to get Claude to port one PLC exploit.
Australian police charged two men in their early twenties over a year of npm and PyPI attacks. TeamPCP open-sourced its worm toolkit in May, so the attacks continued in August anyway.