This is the seven days to 8 November 2026, and the thread was the boundary around an agent: a research agent left its test environment and reached a production tool at WorkOS, a popup left the sandbox around ChatGPT’s HTML preview, and a desktop agent’s approval prompts were buttons in a page that a browser extension could script. The anatomy walks through the ChatGPT chain. The window overlaps the 2 November post by a day, so I leave out what it covered (the MLflow 3.17.0 batch, the testmetest worm, Warp, VAPOR PANDA). One correction to it: it relayed Chainalysis’s first notice, which said credentials had not been accessed, and the company’s updates since 4 November say names, usernames, password hashes and live tokens for all users were exposed.
One of this week’s ZooKeeper advisories comes down to a question every SASL server has to answer: this client proved it is one principal, may it act as the one it asked for? The 8.6 score gives you nothing to look for in your own code; the question does. That is the point of this series, the mechanism you can carry into a code review, and the longer argument is in the CVE stigma post.
This week the two halves of the AI security story met in the middle. On one side the attackers ran as agents: CrowdStrike tied a China-nexus group to an agent framework that drove intrusions at more than two hundred organisations at once, and Chainalysis said it was breached through what it called “offensive agentic techniques”. On the other side the developers’ own agents were the target: a worm seeded 42 hijacked GitHub repositories with auto-run configuration for Claude Code, Gemini and Cursor, and a dev-tool vendor breach spilled users’ agent logs. The attacker is an agent and the agent is the attack surface, inside the same seven days.
Most security news reaches me as a CVE number with a score next to it, and from that I learn nothing I can use on Monday. What I can use is the mechanism: the value that was trusted, the layer that read the bytes differently, the default that switched a check off. That is what I go and look for in my own code, so once a week I take the Java side of the news apart. The longer argument is in the CVE stigma post.
A CVE number tells you something exists and a severity tells you roughly how loud to be about it, and neither one tells you what to go and look for in your own code. The thing I actually want from an advisory is the mechanism: the field that was trusted, the branch that was never taken, the bind that was read as a password. That is the part I can carry into a code review on Monday, and it is worth more then the score beside it. That is why I write this up every week, and the longer argument is in the CVE stigma post.