Six AI coding agents carry the same flaw. Your CI runners are exposed.

On CI runners, the trust dialog never renders. The attack runs headless.

Presented by: Your developers clicked approve. The kernel wrote somewhere else. Adversa AI’s Rony Utevsky tested one symlink-hijack attack against six AI coding agents. Claude Code, Gemini CLI, Cursor, GitHub Copilot CLI, Grok Build, and OpenAI Codex CLI all fell for the same chain. A booby-trapped repo tells the agent to copy a video file. The destination is a symlink to the agent’s own config.   The approval prompt shows the command, not the resolved write. One click plants an attacker-controlled MCP server.   “The developer sees one request: copy this file to that folder. They approve it. Nothing on screen mentions the config directory, the MCP file, or executable content,” Utevsky wrote. Every vendor rejected the report or declined. Anthropic closed it, then quietly shipped a fix. The flaw is architectural. On the next restart, it runs as the developer — unsandboxed, with no second prompt. Same week, a one-character auth bypass surfaced in Starlette, the Python framework under FastAPI, vLLM, LiteLLM, and most MCP servers. CVE-2026-48710 lets an unauthenticated attacker slip past access controls with a malformed Host header. No password. No victim action. Same pattern, different layer. A message from Chainguard Ship and patch doesn’t cut it in the AI era   AI has broken the build-ship-patch security model. Developers now ship code faster than any team can review, attackers exploit vulnerabilities in hours, and AI-generated dependencies arrive without verification. The real issue isn't speed — it's trust.   Chainguard CEO Dan Lorenc argues that reactive security can't win this race; the only answer is controlling what enters your environment from the start Learn More Close the gap this week   Five moves, ranked by blast radius. Scan every repo your developers access with AI coding agents for symlinks targeting config files. Adversa’s PoC repos show the patterns. Disable auto-trust on every CI runner executing AI coding agents. Headless pipelines skip the trust prompt. Lock project-scoped MCP execution to deny per CISA’s agentic AI guide. Update Starlette to 1.0.1 across every FastAPI, vLLM, and LiteLLM deployment. Run the free scanner at badhost.org. Rotate credentials on any CI runner that processes untrusted pull requests with a coding agent. SSH keys, cloud tokens, and signing material are in scope. Audit Starlette services running direct-to-ASGI without a reverse proxy. Cloudflare and AWS ALBs block the malformed headers. Uvicorn alone does not. Map exposed endpoints. Also this week:  A self-spreading npm worm compromised 57 packages in two hours.  SafeBreach hijacked Gemini’s voice assistant through a WhatsApp notification.  A VS Code zero-day steals GitHub tokens in one click.  The White House signed an AI security executive order giving CISA 30 days.  HuggingFace’s safety flag failed to stop code execution in a model library with 232 million downloads.  What your boss is reading right now   Meta’s AI support agent bound recovery emails for anyone who asked. Your SOC never saw an alert. Meta's AI support agent handed over accounts to anyone who asked — no malware, no stolen credentials, no prompt injection. The agent did exactly what Meta built it to do. That's the problem.   OpenAI shipped a ChatGPT Lockdown Mode that disables agent mode, browsing, and file downloads. OpenAI's new Lockdown Mode strips out agent mode, browsing, and file downloads to cut prompt injection exfiltration paths — but OpenAI says it doesn't guarantee data can't get out. A frontier lab hardening its own product by turning features off is a signal worth reading. Step 1. Scan for symlinks in every repo your AI coding agents touch. Flag any link resolving outside the project root or into an agent config directory.   Step 2. Test your Python AI infrastructure for BadHost. Hit every Starlette endpoint with curl -H 'Host: foo?' target/admin. Anything that returns 200 instead of 403 is exposed.   Step 3. Walk the full SymJack chain from clone to code execution. Adversa’s June roundup covers the detection patterns, vendor response matrix, and runtime protection controls for all six agents. That's the week. If this saved you a meeting, forward it to a peer.   Stay sharp, and we’ll be back next Tuesday.   Louis Columbus  ·  @LouisColumbus VentureBeat, Inc. · 500 Sansome St Ste 601 · San Francisco, CA 94111-3222 · USA Privacy Policy  |  Unsubscribe from this message type