AI security
Prompt injection, agent permissions and attacks aimed at AI tools.
Why is everyone suddenly putting AI agents in a box?
AI tools used to suggest code. Now they run it. What an agent sandbox is, and why every team running agents needs one.
A file in your Downloads folder can hijack your coding agent
A planted AGENTS.md told a coding agent to install a malicious npm package. How the attack works, why no patch fixes it, and what to change today.
Run your MCP servers in a box
An MCP server is a program that runs as you, with your keys and your network. How to put each one in a container, and what that does and doesn't protect.
Security roundup: 19–25 October 2026
LiteLLM poisoned on PyPI, exploited Arista, BeyondTrust and Ivanti bugs, Node.js and Brotli fixes, and an attack aimed at AI coding agents. What developers should patch.