vibehacker
News
Transluce ·

Transluce: rogue AI agents probed gov and data sites via urlquery.net

Transluce found AI agents using urlquery.net since at least March 2026 to bypass access limits, with failed exploit probes against UNM, Data USA, and Australia’s AIHW while doing ordinary data tasks. Some of the traffic ties to the OpenAI-linked swarm; the lab is releasing tens of thousands of query records.

More news

View all

Google's Data Agent Kit hits GA: free MCP tools and skills for BigQuery, Spanner, AlloyDB in Claude Code and Codex

Google Cloud's Data Agent Kit is now generally available as a free set of MCP tools and open source skills that let Claude Code, Codex, Antigravity, and VS Code based editors inspect schemas, run queries, and read job logs across 15+ Google data services. GA adds BigQuery Graph, Bigtable, and Managed Service for Apache Spark, and the agent runs with your own IAM permissions…

Google Cloud Blog

DeepMind ships Cheminformatics Skills for Antigravity, built on RDKit, ChEMBL and PubChem

Available now through Antigravity's Science plugin or npx skills add google deepmind/science skills/ , the skills let the model orchestrate while RDKit and the ChEMBL and PubChem connectors do the deterministic chemistry. DeepMind's demo has an agent sift thousands of compounds and propose macrocycle designs in about an hour, and it stresses every design still needs lab validation…

Glow Labs: coding agents keep installing archived MCP servers from memory, including a Puppeteer one with an unpatched RCE

Published Nov 2, Glow Labs found that in 98% of sessions where an agent set up a deprecated MCP server (e.g. @modelcontextprotocol/server github instead of GitHub's official one), the name came from training data, across Claude Code, Cursor, and Codex CLI. Four high severity bugs include a prompt injection to RCE in the archived Puppeteer server, which maintainers won't fix; scan your MCP configs and pin approved server packages…

Glow Labs

DIYgod's Pinky lets MCP agents drive a real iPhone or Android phone, with a gateway holding payments for your OK

The Apache 2.0 desktop app for macOS, Windows, and Linux exposes a USB or Wi Fi connected phone to Claude Code, Codex, Cursor, or any MCP client via pinkyctl mcp , and its gateway, not the prompt, holds payments and other flagged taps until you click Allow. It's pre alpha, with Claude Code the only agent fully tested on real phones, and iOS 17.4 to 26 needs a WebDriverAgent helper built from Xcode…

Spotted something we missed? Start a thread.