Mike Moore’s open red-team lab (covered by RuntimeWire, Sept 18) shows an MCP server can put attacker-written instructions into agent context at connect/discover time—before the first tool call—and a public discovery cache can spread them to another caller. Spec issue MCP-2026-015 is still open; Claude Code loads server instructions at session start but caps each at 2KB.
Cycode found the official MCP Python SDK (1.9.1–1.29.1 / 2.0.0–2.1.1) could skip issuer checks on OAuth discovery fallbacks, letting a malicious MCP server harvest client secrets, auth codes, and PKCE keys (GHSA qx49 fqc8 xw99, CVSS 7.5). Fixed in 1.30.0 / 2.2.0—machine to machine providers also need an explicit issuer= argument…
At DevDay (Sept 29), OpenAI expanded Sign in with ChatGPT so Plus/Pro subscribers can burn ChatGPT Work/Codex allowance inside Amp, Devin, Warp, OpenClaw, OpenCode, Notion, Vercel, and other launch partners—with per app weekly caps that stop included usage instead of auto billing the partner…
Anthropic’s claude api skill adds /claude api build eval (guided eval design in your repo) and /claude api hillclimb (one change per round tuning with a held out set to catch overfitting). On an internal support bench, hillclimb lifted search accuracy from 74.4% to 98.9% while cutting cost to about one fifth…
Claude Code 2.1.285 (npm Sept 29) adds CLAUDE CODE DISABLE WEB FETCH to turn off WebFetch and a managed allowedProviders policy so admins can lock machines to Anthropic, Bedrock, Vertex, Foundry, or a cloud gateway. It also ships claude desktop , claude plugin configure , and a fix for URL passwords leaking past log redaction…
Glow Security found 13,000+ internal screenshots from 343 orgs on public GitHub—coding agents hosted before/after UI images there because GitHub has no CLI image upload for private PRs. About a third involved gitshot’s public by default image repo; the rest were agents creating their own public workarounds…
Spotted something we missed? Start a thread.
