SSH

AI coding agents pose a new security threat by potentially transmitting sensitive local credentials to external AI models during context collection. To mitigate this, organizations must implement deterministic secrets detection at the point of agent file access and prompt submission.

QuoteBench is a new benchmarking framework that exposes how the execution environment of LLM agents can corrupt Bash commands through parsing errors. It demonstrates that high 'matched' success scores often hide significant failures occurring at the boundary between model output and shell execution.

An attacker successfully compromised 42 TanStack npm packages by chaining GitHub Actions cache poisoning with OIDC token extraction. The breach allowed for the unauthorized publication of malicious versions that could exfiltrate sensitive cloud and infrastructure credentials.