NVD published CVE-2026-108953 on Oct 12 for cfdude's mac-shell-mcp: before 2.0.0, clients (or malicious prompts) can call a whitelisted command like pwd with a semicolon in the arguments and run forbidden shell as the server user without approval. Upgrade to 2.0.0 or later.
Penn State, Montpellier, and Dartmouth showed LangGraph, AutoGen, Google ADK 2.0, AWS Strands, Microsoft Agent Framework, and CrewAI will execute a structured tool call if the model is prompted to echo it—even when the model later refuses. Their ToFu fuzzer also confirmed 253 bugs across 118 open source MCP servers, including 64 path traversal and three command injection flaws…
Xiamen University et al. open ProgramGym: 1,648 verifiable C/C++/Go/Rust environments built from GitHub repos for agents that rebuild programs from black box behavior, plus a role isolated Program Agent harness. Fine tuning Qwen3.8 27B on its trajectories raised ProgramBench from 34.87% to 42.84%; with Program Agent the SFT model hit 56.25%…
After you connect a GitHub repo and enable code review, comment @codex review (or turn on Automatic review) and Codex posts a P0/P1 review that follows AGENTS.md Code Review Rules; research preview Security Review uses @codex security review . You can then ask @codex fix the P1 issue to push a follow up fix to the branch when it has permission…
Subquadratic's public preview Snap scores bounded answers (yes/no, choice, score) over up to 384K tokens of text and images in about a second at 100K, so coding agents can offload file selection, tool choice, and test verification while leaving generation to a frontier LLM. It averages 67.6 vs Jev's 61.6 on 16 enterprise Decision Index tasks, costs $0.05 per million input tokens with free outputs, and uses Subquadratic Sparse Attention instead of quadratic prefill…
Marco Montanari's MIT MCP server (one stdlib Python file) creates a git folder, starts claude remote control in screen , and lets you follow from claude.ai/code, optional code server, or Telegram. It ships a storage free OAuth 2.1 layer for claude.ai connectors, bracketed paste into the TUI, and Stop hooks that relay replies and permission asks…
Spotted something we missed? Start a thread.