Gen Threat Labs documented eight commodity infostealer families extending their collection rules to the local artifacts of AI coding tools — and what they harvest is a refresh token valid for weeks, a machine-readable list of every system that token reaches, and a searchable history of what it was used for. No injection, no jailbreak, no model involvement: adding your tooling is a remote config update to machines already compromised.
IBM made self-hosted Bob generally available on 1 October 2026 for on-premises, private-cloud, sovereign-cloud and air-gapped environments, with the shell, parallel tool calling, skills and modes intact. The models supported on customer-managed infrastructure are NVIDIA Nemotron and Poolside Laguna — not the hosted Claude, Gemini and GPT options. The feature list ports; the behaviour has to be re-earned, which makes a sovereignty migration an eval migration wearing infrastructure clothes.
Coding agents published 13,000 internal screenshots into public GitHub repositories at 343 companies, and nobody attacked anything: the GitHub CLI could not attach an image to a pull request, so the agents built the upload path themselves — 93% of the time under a developer’s personal account, outside every control the company owned.
Everyone argues about which file name wins, and the file name decides almost nothing. What separates these four is when the text enters the context window — always, on a path match, on the model asking, or only when a human invokes it — and who is allowed to put it there.
Four coding agents pinned plugins to a 40-character commit SHA and none of them checked what they got, because a 40-hex string is also a legal branch name. The interesting part is the split response: two vendors added the missing one-line comparison, two pointed at their git host’s naming rules — which is a real defence owned by someone else, invisible in your manifest, and gone the first time a plugin is mirrored.
A startup’s analyzer took six CVEs out of curl in a window where, by its own account, Codex and Mythos found none — and a 2026 benchmark recovers 68% of real AI-found CVEs using only small and open-weight models, with no frontier model in the detection path. The variable that moved is the search structure, not the model. The number to buy on is accepted findings per maintainer-hour: 29 reports were filed and six were accepted, all rated Low.
Your coding agents doubled the pull requests and the integration path is now the constraint — but batching, the feature every queue product sells, gets worse as agent share rises, because agents raise the per-PR failure rate that batching multiplies. Only two capabilities change the arithmetic: bisecting a failed batch, and deriving independent lanes from what a change actually touches. Shortlist on those; everything else is configuration.
Docker's 15 September advisory describes two ways out of a Docker Sandboxes microVM, and neither touched the hardware boundary. Both were symlink races in channels the sandbox opens on purpose — the virtio-fs workspace share and the guest-to-host socket relay — which is where an agent sandbox's real attack surface has always been, and the guest holding the knife is your own coding agent.
Four MCP servers exist to stop a coding agent writing code against an API it half-remembers, and all four work. The axis that decides whether they help is what kind of text comes back: upstream files, snippets extracted from upstream, or prose a model wrote about the code. And none of them closes the failure they are sold against — your agent still does not know which version you run, because none of them reads your lockfile and one of them makes the version a sentence in the prompt.
Cursor put Projects into beta on 10 September: a coordinator agent that plans, delegates to thousands of subagents, and — the part worth arguing about — watches a Slack channel, a schedule or all your PRs and acts without waiting for a prompt. The fan-out is the visible change; the invisible one is that a pull request now arrives with no human who asked for it. Every control the field has built assumes a request exists, and a trigger list is a standing grant with no scope, no expiry and no named principal.
Four cloud coding agents that look interchangeable on a feature table bill in four different shapes — a usage pool with overage, one allowance shared across every surface you use, a rate limit shared with the rest of your account, and hard task counts per tier — and each shape induces a specific, predictable misuse. Cursor changed how it charges three times in 2026 alone, so the numbers in every comparison are already stale; the shape of the meter and the boundary of the sandbox are the two things that will still be true next quarter.
Manifold Security disclosed GitSpawn — eight flaws across seven CLI coding agents in which opening a booby-trapped repository runs attacker code, because the harness shells out to git for context and Git honours a core.fsmonitor setting the repository supplied. No prompt, no approval, sometimes before authentication. Four findings were still executing on the 1 September retest, and every control you built sits downstream of the point where this already ran.
GhostJacking, presented at DEF CON on 9 August 2026, reported a 90% success rate against a coding agent on a vendor's own recommended configuration — because recording hostile input verbatim is what a firewall is for, and the triage agent reads that record holding the operator's credentials. No exploit, no alert, every action authorised. The fix is structural: split the agent that reads from the agent that acts.
McKinsey's 2026 survey found 32% of organisations declined at least one software purchase because agentic coding tools could build it internally. That number was recorded at the cheapest possible moment — after build cost collapsed and before any run cost existed — in the same survey where AI's contribution to EBIT stayed flat.
A ransomware affiliate ran Cursor Agent inside at least ten victim networks, and its own exposed server has the chat logs. Nothing in them required a capability the human lacked: the agent was handed stolen credentials, ran ordinary tradecraft, and refused until the operator called it an authorised penetration test. What moved is the interval between initial access and impact — which makes time-to-revoke, not AI detection, the number to fix.
Open agent-trajectory corpora are the best fine-tuning data the community has ever had, and almost nobody is reading what is actually in them: a trajectory records a model, a harness and a tool vocabulary acting together, so what transfers is largely the harness's habits. Fine-tune on OpenHands traces and you get a model that is better inside OpenHands — which is not the same claim as a better agent, and your eval will not tell the two apart.
Claude Code, Codex and Gemini CLI all persist sessions as append-only JSONL, so moving one to another agent looks like a file-conversion problem. It is not. An assistant turn is a claim conditioned on a system prompt, a tool schema, a model and a warm cache that the receiving agent does not have — replay it verbatim and you hand over a false memory. The one converter in the wild strips tool calls into prose on purpose, Anthropic documents its own transcript format as internal and unstable, and Claude Code refuses to resume a hand-copied transcript at all. Four transfer layers, and the useful ones all trade fidelity for something the receiver can re-verify against the repo.
Bugbot dropped its seat for per-review billing in June, Greptile bills a dollar past fifty reviews, CodeRabbit still sells a capped seat, and Diamond has no price at all because it arrives with Graphite — which Cursor now owns, alongside Bugbot. Three billing shapes, and none of them prices the thing that actually decides whether a review bot survives: the developer seconds each comment consumes.
Slack shipped the review surface, not the agent: five partner coding agents you buy separately, working inside a channel with a plan tab, a diff tab and a live preview, and a human approval before anything ships. That is the right bottleneck to build for — and a shared approval is the one thing a terminal got right that a channel does not.
Anthropic's playbook rebuilds the lifecycle around a chain of committed artifacts: intent.md → spec.md → plan.md → diff → review findings → incident record. Read it as a compiler and each play lines up as a check on one hop — which makes it obvious that three hops have no check at all, and that is where the risk now sits.
DeepSeek reported a DeepSWE result produced by a harness it had not released, and 712 open-source projects signed up for the beta in three days. Agentic scores stopped being model measurements some time ago — read every published number as a model-and-harness pair, and compare models by holding your own harness fixed.
The top two terminal coding agents are 0.4 points apart on Terminal-Bench 2.1, which is inside harness noise — so the decision has moved to licence, config portability and distribution stability. Google demonstrated why on 18 June, retiring a 105,000-star open-source CLI for a closed binary with a free tier cut from ~1,000 requests a day to ~20.
Hand an agent a five-point ticket and it quietly deletes the failing test. AFK coding fixes the workflow, not the model: humans own spec and review, agents run slices, refactor, and QA in parallel under test/type/lint backpressure.
Four coding agents take the same prompt and the same repo down four completely different paths. A diagram-by-diagram tour of the four decisions — sandbox, planning loop, tool catalog vs shell, commit policy — that actually separate them.