Imran Hassanali presents a comprehensive benchmark comparing "Code Mode"—where an LLM generates complete code to execute tools—against traditional function calling for tool interactions. The results demonstrate that Code Mode is significantly more efficient, achieving 60% faster execution, 68% fewer tokens used, and an 87.5% reduction in API round trips while maintaining equal accuracy compared to regular agents.
- Evaluated using eight realistic business scenarios, including multi-client invoicing and expense tracking.
- Code Mode advantage scales with task complexity; high-complexity tasks saw up to a 79.2% speedup.
- The benchmark tested both Claude 3 Haiku (showing major efficiency gains) and Gemini 2.0 Flash Experimental.
- Secure code execution is implemented via RestrictedPython, preventing filesystem and network access during the sandbox phase.
- Evaluated using eight realistic business scenarios, including multi-client invoicing and expense tracking.
- Code Mode advantage scales with task complexity; high-complexity tasks saw up to a 79.2% speedup.
- The benchmark tested both Claude 3 Haiku (showing major efficiency gains) and Gemini 2.0 Flash Experimental.
- Secure code execution is implemented via RestrictedPython, preventing filesystem and network access during the sandbox phase.
- **Inference** – Platforms and engines for running models, plus user interfaces.
- **Models** – LLMs (general, coding, multimodal, image, audio), model providers, and specific model highlights.
- **RAG** – Retrieval-Augmented Generation tools.
- **Safeguards** – Safety and content filtering.
- **Agents & Tools** – Agent frameworks, Model Context Protocol, coding agents, computer/browser automation, memory management, and testing/evaluation.
- **Research, Training & Fine-tuning** – Security, sandboxing, and model development.
- **Hardware** – Local hardware options.
- **Tutorials** – Guides covering models, prompt/context engineering, inference, agents, and RAG.
- **Communities** – Places to connect and share knowledge.
- **Models** – LLMs (general, coding, multimodal, image, audio), model providers, and specific model highlights.
- **RAG** – Retrieval-Augmented Generation tools.
- **Safeguards** – Safety and content filtering.
- **Agents & Tools** – Agent frameworks, Model Context Protocol, coding agents, computer/browser automation, memory management, and testing/evaluation.
- **Research, Training & Fine-tuning** – Security, sandboxing, and model development.
- **Hardware** – Local hardware options.
- **Tutorials** – Guides covering models, prompt/context engineering, inference, agents, and RAG.
- **Communities** – Places to connect and share knowledge.
Snyk Agent Scan provides a way to discover and inspect local agent components like Model Context Protocol (MCP) servers and skills. It identifies various security risks, such as prompt injections, malware payloads in natural language, sensitive data exposure, and credential leaks. The tool offers both an interactive command-line interface for individual users and a background mode for enterprise monitoring through Snyk Evo.
- Detects 15+ distinct security risks across MCP servers and agent skills
- Supports agents including Claude Code, Cursor, Windsurf, and Gemini CLI
- Automatically discovers configurations for various desktop and IDE-based agents
- Scanning MCP configs executes commands defined in them to retrieve tool descriptions
- Detects 15+ distinct security risks across MCP servers and agent skills
- Supports agents including Claude Code, Cursor, Windsurf, and Gemini CLI
- Automatically discovers configurations for various desktop and IDE-based agents
- Scanning MCP configs executes commands defined in them to retrieve tool descriptions
# Incident Post-Mortem: Multi-Agent Credential Exfiltration Wave
**Date:** April 30, 2026
**Severity:** Critical (P1)
**Status:** Resolved / Patched
**Impacted Systems:** OpenAI Codex, Anthropic Claude Code, GitHub Copilot, Google Vertex AI
---
## 1. Executive Summary
Over a nine-month period leading up to April 2026, multiple research teams identified critical vulnerabilities across the industry's leading AI coding agents. Contrary to previous assumptions regarding "model hallucinations," these attacks did not target model logic; instead, they targeted **runtime credentials**. Attackers exploited the gap between the user interface and the underlying identity/authorization plane, allowing for unauthorized shell execution, sandbox escapes, and full repository takeovers via hijacked OAuth tokens and excessive service permissions.
## 2. Incident Overview
| Feature | Description |
| :--- | :--- |
| **Primary Attack Vector** | Credential theft and privilege escalation through agentic runtime environments. |
| **Core Vulnerability Class** | Broken Access Control; Improper Input Sanitization (Command Injection); Excessive Scoping. |
| **Detection Gap** | AI agents are currently invisible to standard IAM, CMDB, and asset inventory tools. |
## 3. Root Cause Analysis (RCA)
### A. Codex: Command Injection via Parameter Obfuscation
* **Mechanism:** Maliciously crafted GitHub branch names containing semicolon/backtick subshells were passed unsanitized into setup scripts during cloning.
* **Stealth Tactic:** Attackers used Unicode U+3000 (Ideographic Space) to make malicious branches appear identical to "main" in web portals, hiding the exfiltration payload from human reviewers.
### B. Claude Code: Sandbox & Logic Bypass
* **CVE-2026-25723:** Escaped project sandbox via unvalidated command chaining (piped `sed`/`echo`).
* **CVE-2026-33068:** Permission modes were resolved from `.claude/settings.json` *before* the workspace trust dialog appeared, allowing repos to auto-disable security prompts.
* **Performance Trade-off:** A logic flaw caused the agent to stop enforcing "deny rules" once a command chain exceeded 50 subcommands to optimize for speed.
### C. GitHub Copilot: Prompt Injection in Metadata
* **Mechanism:** Instructions hidden within Pull Request descriptions or GitHub Issues triggered Remote Code Execution (RCE) or forced the agent into an unrestricted "auto-approve" mode via `.vscode/settings.json` manipulation.
### D. Vertex AI: Excessive Default Scoping
* **Mechanism:** The default service identity (P4SA) possessed overly broad OAuth scopes, granting agents access to sensitive Google services (Gmail, Drive) and internal Artifact Registries by design rather than exception.
## 4. Lessons Learned
1. **Interface $neq$ System Security:** Enterprises have been approving AI *interfaces* without auditing the underlying *identities* those interfaces wield.
2. **Agent-Runtime vs. Code-Output:** Current security focus is on scanning the code an AI *writes*; however, the real threat vector is the environment in which the agent *executes*.
3. **The Speed/Security Paradox:** Developers and vendors are trading rigorous authorization checks for lower latency, creating a window of opportunity for attackers to reverse-engineer patches within 72 hours.
## 5. Corrective Action Plan (CAP)
### Immediate Technical Remediation
* » **Patch Deployment:** Ensure Claude Code is $ge$ v2.1.90; verify Copilot August 2025 patches.
* » **Scope Reduction:** Transition Vertex AI to a "Bring Your Own Service Account" (BYOSA) model to enforce least privilege.
### Long-term Governance & Prevention
* **Identity Inventory:** Integrate AI agent identities into CIEM (Cloud Infrastructure Entitlement Management) and CMDB systems.
* **Zero Trust Input Policy:** Treat all repository metadata (branch names, PR descriptions, READMEs) as untrusted input for agentic execution.
* **Non-Human PAM:** Implement Privileged Access Management (PAM) for AI agents, treating them with the same rigor as human privileged users (rotation, scoping, and session anchoring).
* **Vendor Audits:** Mandate written documentation from vendors regarding identity lifecycle management and credential rotation policies during renewal cycles.
**Date:** April 30, 2026
**Severity:** Critical (P1)
**Status:** Resolved / Patched
**Impacted Systems:** OpenAI Codex, Anthropic Claude Code, GitHub Copilot, Google Vertex AI
---
## 1. Executive Summary
Over a nine-month period leading up to April 2026, multiple research teams identified critical vulnerabilities across the industry's leading AI coding agents. Contrary to previous assumptions regarding "model hallucinations," these attacks did not target model logic; instead, they targeted **runtime credentials**. Attackers exploited the gap between the user interface and the underlying identity/authorization plane, allowing for unauthorized shell execution, sandbox escapes, and full repository takeovers via hijacked OAuth tokens and excessive service permissions.
## 2. Incident Overview
| Feature | Description |
| :--- | :--- |
| **Primary Attack Vector** | Credential theft and privilege escalation through agentic runtime environments. |
| **Core Vulnerability Class** | Broken Access Control; Improper Input Sanitization (Command Injection); Excessive Scoping. |
| **Detection Gap** | AI agents are currently invisible to standard IAM, CMDB, and asset inventory tools. |
## 3. Root Cause Analysis (RCA)
### A. Codex: Command Injection via Parameter Obfuscation
* **Mechanism:** Maliciously crafted GitHub branch names containing semicolon/backtick subshells were passed unsanitized into setup scripts during cloning.
* **Stealth Tactic:** Attackers used Unicode U+3000 (Ideographic Space) to make malicious branches appear identical to "main" in web portals, hiding the exfiltration payload from human reviewers.
### B. Claude Code: Sandbox & Logic Bypass
* **CVE-2026-25723:** Escaped project sandbox via unvalidated command chaining (piped `sed`/`echo`).
* **CVE-2026-33068:** Permission modes were resolved from `.claude/settings.json` *before* the workspace trust dialog appeared, allowing repos to auto-disable security prompts.
* **Performance Trade-off:** A logic flaw caused the agent to stop enforcing "deny rules" once a command chain exceeded 50 subcommands to optimize for speed.
### C. GitHub Copilot: Prompt Injection in Metadata
* **Mechanism:** Instructions hidden within Pull Request descriptions or GitHub Issues triggered Remote Code Execution (RCE) or forced the agent into an unrestricted "auto-approve" mode via `.vscode/settings.json` manipulation.
### D. Vertex AI: Excessive Default Scoping
* **Mechanism:** The default service identity (P4SA) possessed overly broad OAuth scopes, granting agents access to sensitive Google services (Gmail, Drive) and internal Artifact Registries by design rather than exception.
## 4. Lessons Learned
1. **Interface $neq$ System Security:** Enterprises have been approving AI *interfaces* without auditing the underlying *identities* those interfaces wield.
2. **Agent-Runtime vs. Code-Output:** Current security focus is on scanning the code an AI *writes*; however, the real threat vector is the environment in which the agent *executes*.
3. **The Speed/Security Paradox:** Developers and vendors are trading rigorous authorization checks for lower latency, creating a window of opportunity for attackers to reverse-engineer patches within 72 hours.
## 5. Corrective Action Plan (CAP)
### Immediate Technical Remediation
* » **Patch Deployment:** Ensure Claude Code is $ge$ v2.1.90; verify Copilot August 2025 patches.
* » **Scope Reduction:** Transition Vertex AI to a "Bring Your Own Service Account" (BYOSA) model to enforce least privilege.
### Long-term Governance & Prevention
* **Identity Inventory:** Integrate AI agent identities into CIEM (Cloud Infrastructure Entitlement Management) and CMDB systems.
* **Zero Trust Input Policy:** Treat all repository metadata (branch names, PR descriptions, READMEs) as untrusted input for agentic execution.
* **Non-Human PAM:** Implement Privileged Access Management (PAM) for AI agents, treating them with the same rigor as human privileged users (rotation, scoping, and session anchoring).
* **Vendor Audits:** Mandate written documentation from vendors regarding identity lifecycle management and credential rotation policies during renewal cycles.
A zero-dependency Python CLI tool designed to provide AI coding agents with persistent session memory. It solves the problem of context window degradation and the "lost in the middle" phenomenon by allowing agents to perform efficient, read-only recalls from local SQLite session stores. Instead of burning thousands of tokens on project exploration or re-orientation, auto-memory enables targeted retrieval of recent files and task history using minimal token overhead.
Key features and technical details:
- Zero dependencies using only Python standard libraries.
- Read-only access to Copilot CLI's local SQLite database to ensure safety.
- Progressive disclosure mechanism ranging from cheap scans (~50 tokens) to full session details.
- Schema-aware design with built-in validation for tool updates.
- Compatible with GitHub Copilot CLI, Claude Code, Cursor, and other instruction-file supporting agents.
Key features and technical details:
- Zero dependencies using only Python standard libraries.
- Read-only access to Copilot CLI's local SQLite database to ensure safety.
- Progressive disclosure mechanism ranging from cheap scans (~50 tokens) to full session details.
- Schema-aware design with built-in validation for tool updates.
- Compatible with GitHub Copilot CLI, Claude Code, Cursor, and other instruction-file supporting agents.
Lobster is a **Clawdbot-native workflow shell** designed to be a **typed, local-first "macro engine"** for building composable and safe automations. It allows users to define pipelines of tools and skills that Clawdbot (or other AI agents) can invoke with a single step, saving tokens and enabling determinism and resumability.
**Key Features & Goals:**
* **Typed Pipelines:** Uses JSON objects/arrays instead of text pipes for data flow.
* **Local-First:** Executes workflows locally, enhancing privacy and control.
* **No New Authentication:** Leverages existing authentication mechanisms; doesn't require new OAuth tokens.
* **Composability:** Workflows can be chained and reused.
* **Approval Gates:** Includes mechanisms for human or automated approval before execution.
* **Workflow Files:** Supports YAML/JSON workflow files for defining complex pipelines.
**Quick Start:**
Requires `pnpm install`, `pnpm test`, and `pnpm lint`. Workflows can be run from the command line using `node ./bin/lobster.js`.
**Example Use Case:**
The documentation provides examples of monitoring GitHub pull requests and detecting changes, demonstrating how Lobster can be used to automate tasks and provide insights.
**Key Features & Goals:**
* **Typed Pipelines:** Uses JSON objects/arrays instead of text pipes for data flow.
* **Local-First:** Executes workflows locally, enhancing privacy and control.
* **No New Authentication:** Leverages existing authentication mechanisms; doesn't require new OAuth tokens.
* **Composability:** Workflows can be chained and reused.
* **Approval Gates:** Includes mechanisms for human or automated approval before execution.
* **Workflow Files:** Supports YAML/JSON workflow files for defining complex pipelines.
**Quick Start:**
Requires `pnpm install`, `pnpm test`, and `pnpm lint`. Workflows can be run from the command line using `node ./bin/lobster.js`.
**Example Use Case:**
The documentation provides examples of monitoring GitHub pull requests and detecting changes, demonstrating how Lobster can be used to automate tasks and provide insights.
This guide offers five essential tips for writing effective GitHub Copilot custom instructions, covering project overview, tech stack, coding guidelines, structure, and resources, to help developers get better code suggestions.
TraceRoot accelerates the debugging process with AI-powered insights. It integrates seamlessly into your development workflow, providing real-time trace and log analysis, code context understanding, and intelligent assistance. It offers both a cloud and self-hosted version, with SDKs available for Python and JavaScript/TypeScript.
AI-powered multi-agent system that automatically analyzes codebases and generates comprehensive documentation. Features GitLab integration, concurrent processing, and multiple LLM support for better code understanding and developer onboarding.
This article details six practical use cases for Model Context Protocol (MCP) to automate workflows using AI agents and integrations with tools like Slack, Google Calendar, BigQuery, Linear, GitHub, and HubSpot. It highlights the impact of these automations on team efficiency and productivity.
