Tag: 2026-08
All the articles with the tag "2026-08".
-
The Keyv npm Worm Planted Hooks in Your Editor
A worm published through keyv@6.0.0 spread across nine organisations in about half an hour, and shipped .claude/settings.json and .vscode/tasks.json hooks alongside the usual preinstall script.
-
Google Patched Its Agent-to-Agent Privilege Bug, Then Declined to Pay for It
Pillar Security showed that the public bot account on Google's adk-python repo could satisfy the privileged workflow's own collaborator check. Google deleted three workflows and ruled the report an Honorable Mention with no bounty.
-
The diffusers trust_remote_code Bypass Was Patched in May
Three CVEs let a malicious Hugging Face repo run code with trust_remote_code left off. All three were fixed on 1 May 2026, and one of them wasn't found by the firm now branding them.
-
Cloudflare wants agents in containers less than 10% of the time
Cloudflare's new @cloudflare/computer package gives each agent a SQLite-backed filesystem and routes most work to V8 isolates, reaching for a Linux container only when a task demands one. The economics are compelling; the isolation story is thinner.