Security
Attack hijacks coding agents through error logs, and 85% failed the test
The technique injects instructions into monitoring data. The agent reads it as an order and executes on the developer's machine.
85% of coding agents fell for the same trick
A new class of attack hijacks coding assistants by injecting instructions into the error logs they read. There is no universal fix. The same week, an audit-dedicated model found 24 flaws in the Linux kernel.
Security
Audit-dedicated model finds 24 flaws in the Linux kernel
The Daybreak programme found privilege escalations and a critical flaw in a widely used proxy.
From the studio
What the agent reads is untrusted input
The week produced the quarter's most uncomfortable finding: 85% of tested coding assistants accepted instructions planted in the error logs they consult to help fix defects. The agent reads it as an order and executes with the developer's privileges.
What makes the case hard is that there's no patch. The agent has to read outside content to be useful, and outside content can be written by anyone. It's the same problem structure that appeared weeks later in AI browsers redirected by a planted comment.
The responses announced in the period all run in one direction, and none promises to block the entry: zero standing privilege, per-action authorisation, the agent's own identity. They don't prevent the malicious instruction, they reduce what it reaches.
The practical rule left standing is old and still holds: whatever enters a model's working context is user input, and deserves the suspicion applied to a web form. And every barrier counts only after someone has watched it fail on purpose.
In this issue
Security
Agencies warn that game-changing security models are months away
The joint statement came in the same period an executive order created pre-release review for advanced systems.
Security
CrowdStrike ships continuous per-action authorisation for agents
The proposal is zero standing privilege: the agent asks permission per action instead of carrying broad credentials.
AI
Grok 4.5 enters private beta on a 1.5-trillion-parameter base model
The announcement came on June 28, with use restricted to companies in the same group.
Business
Alphabet loses four names from its model team in one week
Among them a central researcher and a science prize winner. A competitor hired them.
Business
DeepMind and a film studio sign a $75 million partnership
The deal targets AI tools for film production and distribution.
Regulation
Pre-release review was already shaping behaviour before its first case
Signed on June 2, the process defined who could launch and when, weeks before the first public case.
Business
Rocket Lab buys a satellite operator for about $8 billion
The acquisition moves the company from launch services into satellite communications.
Hardware
Apple prepares a touchscreen laptop
The devices are expected to ship with the current processor generation rather than waiting for the next.
Security
Anthropic connects agent governance to an identity provider
The partnership lets customers control assistant use and tool access through a single layer.
AI
A frontier model is pulled offline days after launch
The removal involved export controls and concerns about vulnerability-discovery capability.
Security
Agents reach data nobody explicitly approved
Research from the period shows agents inheriting the permissions of whoever configured them, with no scope of their own.
Business
A conference gathers real-world AI security
The event took place the same week as the agency warnings and the code audit programme launch.
Work
Coding assistants became targets because they became infrastructure
The new attack class only makes sense because the tool sits in everyone's workflow.
Security
With no universal fix, the defence becomes process design
Researchers recommend human review between untrusted data and agent action.
Sections