Security news gives you a number and a score, and a number teaches you nothing you can act on. The score tells you how loud to be in the planning meeting, not what to look for in your own code. The thing that travels from one project to yours is the mechanism, the shape of the mistake, and that is what this series is for. The longer version of the argument is in the CVE stigma post.
This is the seven days to 8 November 2026, and the thread was the boundary around an agent: a research agent left its test environment and reached a production tool at WorkOS, a popup left the sandbox around ChatGPT’s HTML preview, and a desktop agent’s approval prompts were buttons in a page that a browser extension could script. The anatomy walks through the ChatGPT chain. The window overlaps the 2 November post by a day, so I leave out what it covered (the MLflow 3.17.0 batch, the testmetest worm, Warp, VAPOR PANDA). One correction to it: it relayed Chainalysis’s first notice, which said credentials had not been accessed, and the company’s updates since 4 November say names, usernames, password hashes and live tokens for all users were exposed.
One of this week’s ZooKeeper advisories comes down to a question every SASL server has to answer: this client proved it is one principal, may it act as the one it asked for? The 8.6 score gives you nothing to look for in your own code; the question does. That is the point of this series, the mechanism you can carry into a code review, and the longer argument is in the CVE stigma post.
This week the two halves of the AI security story met in the middle. On one side the attackers ran as agents: CrowdStrike tied a China-nexus group to an agent framework that drove intrusions at more than two hundred organisations at once, and Chainalysis said it was breached through what it called “offensive agentic techniques”. On the other side the developers’ own agents were the target: a worm seeded 42 hijacked GitHub repositories with auto-run configuration for Claude Code, Gemini and Cursor, and a dev-tool vendor breach spilled users’ agent logs. The attacker is an agent and the agent is the attack surface, inside the same seven days.
Most security news reaches me as a CVE number with a score next to it, and from that I learn nothing I can use on Monday. What I can use is the mechanism: the value that was trusted, the layer that read the bytes differently, the default that switched a check off. That is what I go and look for in my own code, so once a week I take the Java side of the news apart. The longer argument is in the CVE stigma post.