Clean GitHub repo tricks AI coding agents into running malware

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...
Windows Report

Mozilla Warns Clean GitHub Repositories Can Trick Claude Code Into Running Malware

Mozilla researchers revealed a new attack that tricks Claude Code into running hidden commands from seemingly harmless GitHub repositories.
Tech Times

Most AI Models Would Run Your Company Into the Ground, Princeton’s CEO-Bench Finds

Princeton’s CEO-Bench gave 14 AI models $1 million to run a simulated SaaS startup for 500 days. Most went bankrupt or lost ...
InfoWorld

Using Visual Studio Code’s ‘air-gapped’ AI model mode

VS Code can use LLM models other than GitHub Copilot’s built-in providers for AI-assisted development, including local and ...
InfoWorld

Visual Studio Code introduces restricted mode for untrusted folders

Workspace Trust feature in VS Code 1.26 lets users configure whether code in a project folder can be executed by VS Code ...
XDA Developers on MSN

I built repeatable agentic AI workflows that code without me, and the results surprised me

All my agents needed was a little bit of codified workflows to follow ...
techtimes

Open-Source Coding Model Ornith-1.0 Writes Its Own Training Scaffold in Reinforcement Learning

DeepReinforce today released Ornith-1.0, a family of open-source coding models built around a mechanism most RL-trained agents avoid: the model itself writes the training harness that guides its own ...
The Hacker News

Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Researchers found Cordyceps CI/CD flaws affecting 300+ repositories, enabling code execution, credential theft, and supply ...
SecurityWeek

Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking

Cordyceps, a systemic class of exploitable CI/CD vulnerabilities, allows unauthenticated attackers to hijack developer ...
Tom's Hardware on MSN

AI coding agents can be tricked into installing malware via 'clean' GitHub repositories

Three levels of indirection, all with seemingly innocuous steps, will catch a bot off-guard.

Blast from the past as GIMP 0.54 is revived in Flatpak form

Development of GIMP has picked up speed in recent years, but now its first public release is back as a Flatpak, allowing the ...

AgileAI Labs Unveils Spec2TestAI's Natural Language No-Code Automated Testing Tool

Addressing the pervasive challenges within the software development lifecycle (SDLC), such as poorly defined requirements, ...