vibehacker
News
Glow Labs ·

Glow Labs: coding agents keep installing archived MCP servers from memory, including a Puppeteer one with an unpatched RCE

Published Nov 2, Glow Labs found that in 98% of sessions where an agent set up a deprecated MCP server (e.g. @modelcontextprotocol/server-github instead of GitHub's official one), the name came from training data, across Claude Code, Cursor, and Codex CLI. Four high-severity bugs include a prompt-injection-to-RCE in the archived Puppeteer server, which maintainers won't fix; scan your MCP configs and pin approved server packages.

Read at glow.io
Claude Code
An AI coding agent for terminal, IDE, web, and Slack

More news

View all

DeepMind ships Cheminformatics Skills for Antigravity, built on RDKit, ChEMBL and PubChem

Available now through Antigravity's Science plugin or npx skills add google deepmind/science skills/ , the skills let the model orchestrate while RDKit and the ChEMBL and PubChem connectors do the deterministic chemistry. DeepMind's demo has an agent sift thousands of compounds and propose macrocycle designs in about an hour, and it stresses every design still needs lab validation…

Google DeepMind Blog

DIYgod's Pinky lets MCP agents drive a real iPhone or Android phone, with a gateway holding payments for your OK

The Apache 2.0 desktop app for macOS, Windows, and Linux exposes a USB or Wi Fi connected phone to Claude Code, Codex, Cursor, or any MCP client via pinkyctl mcp , and its gateway, not the prompt, holds payments and other flagged taps until you click Allow. It's pre alpha, with Claude Code the only agent fully tested on real phones, and iOS 17.4 to 26 needs a WebDriverAgent helper built from Xcode…

GitHub (DIYgod/pinky)

Devin Desktop 3.12.28 adds per-session MCP controls and restores rejected first prompts

Released Nov 7, the Agent Command Center session header menu now lists that session's MCP servers so you can view, toggle, or re authenticate them, and if a local agent rejects the first prompt, Desktop puts the text back in the composer with the reason. The editor also moves to VS Code 1.141.2 and Electron 43.8.3 (Chromium security fixes), and permission requests from third party ACP agents no longer crash the conversation view…

Devin Docs

ASE 2.0 adds a headless agent pipeline and live task boards to its Claude Code plugin

Announced Nov 8, the Apache 2.0 toolkit's 2.0 release lets planner, implementer, qualifier, and integrator agents drive tasks headless from plan to merge ( ase agent fleet start ), shown live on terminal and browser task boards, with tasks stored as Markdown or as GitHub, GitLab, or Gitea issues. It runs fully in Claude Code and with reduced features in Copilot CLI and Codex CLI, now needs Node.js 22.18+, and renames or removes several 1.x skills (DEV)…

ASE (Agentic Software Engineering)

Spotted something we missed? Start a thread.