A Google/Microsoft-backed proposal lets your page hand an AI agent real callable tools instead of screenshot-and-guess. Chrome's already trialing it. But it's a W3C draft (not a standard), the API is churning, and the security fine print is stark: tools run with your logged-in auth and there's no mandated consent model. Clever, and a new attack surface — both at once.
Technitium is a lovely all-in-one DNS server — authoritative, recursive, and ad-blocking. I run it, but I do NOT let it be the authoritative nameserver for my domain. On one box that turns 'my site is down for an hour' into 'my domain doesn't exist for an hour' (site, email, subdomains — all gone). Where the line is, the hidden-primary pattern, and the open-resolver risk.
An AI agent wiped PocketOS's production database and its backups in nine seconds (April 2026). Strip out the AI and you find three ordinary failures: an overprivileged token that outlived its purpose, backups sharing a volume with the data, and no gate on destructive actions. Every 'rogue AI' headline is an IAM-and-backups failure in costume — and it's the exact fear from my Coolify-MCP post, realised.
I've never configured a cipher on this blog, yet it negotiates hybrid post-quantum key exchange (X25519MLKEM768) by default — the same group as cloudflare.com — because Traefik's Go runtime switched it on. What that is, why it arrived for free, the caveats (it depends on the Go build; a 'hardened' curve config can silently disable it), and the honest 'it changes almost nothing for a public blog' verdict.
CVE-2026-45034 (CVSS 9.2) bypasses an earlier PhpSpreadsheet fix because one extra slash makes parse_url() return false, walking past the guard and re-enabling phar deserialization. The real villain isn't the library — it's using parse_url() as a security boundary, a recurring PHP footgun the advisory itself warns against.
Two fresh RCEs — Gitea's diffpatch hook (CVE-2026-60004, 9.8, open registration on by default) and n8n's Git node (CVE-2026-21877, 9.9) — make the one-box lesson concrete: default-open signup turns 'authenticated' RCE into anonymous RCE, and co-located apps share a blast radius. Kill open signup, segment Docker networks, don't co-locate automation with a public site.
The Aug 4 keyv/'ChainDrop' npm worm planted payloads in AI-agent and editor config — .claude/settings.json SessionStart hooks, .vscode/tasks.json runOn:folderOpen — that fire when you or your agent just open the folder. And it shipped with valid provenance, because the source was poisoned before the trusted build. Opening a repo is now a code-execution decision.
CVE-2026-71488 in league/commonmark — the Markdown parser behind Laravel, Drupal, Statamic and more — turns a single non-ASCII character into O(n²) parsing. No RCE, no leak, just one long line with an emoji pinning a CPU. Why algorithmic-complexity DoS is the vuln class nobody threat-models, and why you should benchmark parsers with adversarial input.
A July 2026 Concordia benchmark (IssueTrojanBench) found 66.5% of malicious instructions hidden in GitHub issues bypassed every guardrail in Cursor, Claude Code and Codex — and nearly every block came from the base LLM refusing, not the agent's own safety layer. What that means if you point an agent at anything you didn't write.
Wiz disclosed a symlink flaw (July 8) letting a malicious repo trick six AI coding assistants — Claude Code included — into writing to your ~/.ssh while the approval dialog showed a harmless filename. How it works, the CVEs, Anthropic's fair-to-note dispute, and why the approval prompt was never my real security boundary.
