Default hard budget caps: the missing control for agent-built software
Coding agents make it trivial to wire up paid APIs and hosting, and a runaway loop can turn into a large bill before an alert email is read. Simon Willison argues that hard, default-on spending caps are now a baseline control, and AWS and Google Cloud have both begun shipping them.
Dependabot's 72-hour wait and PyPI's 14-day file lock: what they stop
GitHub and PyPI have each added a time-based control against package poisoning. They shrink the window in which a malicious release can spread, but they do not stop a compromise.
GitLab AI Gateway CVE-2026-90970: 9.9 Flaw Allows Command Execution
A prompt-template sandbox escape in the GitLab AI Gateway lets an authenticated Duo Agent Platform user run commands on the gateway host. Only self-hosted gateways need action, and no workaround is listed.
GitLost: A Public GitHub Issue Tricked an Agentic Workflow Into Leaking Private Repos
Noma Labs showed that a GitHub Agentic Workflow with cross-repository read access could be steered by a crafted issue into posting private repository content as a public comment. The flaw is architectural, and it applies to any AI agent in CI/CD that reads untrusted text.
Coding agents make software engineering harder, says Simon Willison
Simon Willison argues that coding agents raise the bar on discipline and knowledge rather than lowering it. Here is what that means for security teams.
Cloudflare Python Workers Hit GA: What the WASM Sandbox Means for Security
After two years in preview, Cloudflare's Pyodide-on-WebAssembly runtime for Python is now production-grade — and it quietly reshapes the isolation model and supply-chain surface teams need to think about.
Wrapture's Zero-Code Monkey-Patching Is a Supply-Chain Question, Not Just a Dev One
Graham Dumpleton's new Python library wrapture patches arbitrary call sites for testing and tracing without touching source code — a capability worth reviewing like any other dependency with deep runtime access.
EVE Online's Python 3 Migration Is a Masterclass in Legacy Runtime Risk
CCP Games is finally moving 2.4 million lines of EVE Online off Python 2 — six years after the interpreter stopped receiving security fixes. It's a useful case study in how technical debt in a runtime, not just an application, becomes a security liability.
Mojo Goes Fully Open Source: The Supply-Chain Angle for AI Infra Teams
Modular has released the Mojo compiler and toolchain under Apache 2.0, three years after first promising it. For teams building GPU/AI workloads on Mojo, the interesting part isn't the license — it's what opening the compiler changes about trust and contribution risk.
Datasette's New Upload API Turns a Bearer Token Into a Production Database Swap
The datasette-upload-dbs 0.5a0 release formalises a POST API for hot-swapping a live SQLite database — a convenient CD primitive that is only as safe as the bearer token and permission scope guarding it.
npm's Keyv and Cacheable Hijacked in 'Mini Shai-Hulud' Supply-Chain Worm
A hijacked maintainer account let attackers trojan keyv, cacheable-request and flat-cache — reusing the same Shai-Hulud toolkit seen on PyPI and npm earlier in 2026.
The "Meat Proxy" Problem: Why Unread AI Output Is a Security Risk
A new term for an old failure mode — relaying AI output without reading it — has real consequences when the output is a vulnerability triage, an incident runbook, or a pull request.
CVE-2026-63077: Critical TeamCity Flaw Enables Unauthenticated RCE
A critical bug in the agent polling protocol lets an unauthenticated attacker with network access to a TeamCity On-Premises server run arbitrary OS commands — no credentials required.
Lobste.rs moves to SQLite: a lesson in shrinking your attack surface
The tech-news community site Lobsters has retired MariaDB in favour of SQLite after an eight-year migration effort — a small architectural decision with a useful security lesson about trading network attack surface for single-host risk.
AI Writes the CI/CD Pipeline: Auditing AI-Generated GitHub Actions Workflows
Simon Willison's browser-compat-db used two AI models to generate a complete build pipeline — a sign of where development is heading and a prompt to ask whether security review has kept pace.