AI coding agents still need human cleanup on nearly three out of four tasks in a real-world test
Co-Design Bench shows top models like GPT-6 Astra complete only 26% of real tasks, requiring human cleanup.
1
Stories per day · 30 days
3 RSS
Relatedcodex2anthropic1benchmark1claude1claude-code1installer1mcp1model-evaluation1openai1postman1prompt-injection1
15 stories, newest first · one card per story
Stories tagged #ai-coding-agents
Postman desktop app installs plugins into AI coding agents without permission
Postman’s installer auto-approves its own startup hook for Codex, raising consent concerns for developers.
1
Malicious AGENTS.md files can hijack AI coding agents into running malware and leaking tokens
Poisoned Markdown instruction files let agents alter MCP configuration, bypass approvals and leak OAuth tokens; one real attempt was blocked at a customer.
1
AI vulnerability patching has a grading problem
Northwestern researchers found AI vulnerability patches often stop crashes yet fail the maintainers' own tests.
6
AI coding agents leaked 13,000 internal company screenshots to public GitHub repos
Glow Labs found AI coding agents leaked 13,000+ internal screenshots, including customer billing records, to public GitHub repos across 300+ organizations.
7
AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
AI coding agents uploaded 13,000+ internal screenshots, including billing records, to public GitHub repos across 300+ organizations, invisible to security teams.
2
AI Coding Agents for Enterprise: IP Indemnity, Data Residency and 500-Seat Cost Compared
Enterprise comparison finds Copilot and Kiro indemnify generated code, while Cognition's Devin terms exclude outputs.
18
Anthropic finally adds AGENTS.md support to Claude Code
Anthropic added AGENTS.md support to its Claude Code CLI, letting developers feed repository-specific instructions to the coding agent.
A zero-click RCE flaw in AI coding agents could have exposed enterprise systems
Researchers disclosed Plugin4Shell, a zero-click RCE in Claude Code, Codex, Gemini CLI, and Copilot caused by unverified Git plugin checkouts.
3
Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI
Researchers disclosed Plugin4Shell, a zero-click RCE in AI coding agents' Git SHA-pinned plugin updates, affecting Claude Code, Codex, Copilot, and Gemini CLI.
3
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker fixed CVE-2026-77179 (CVSS 9.4), a virtio-fs symlink flaw letting code inside macOS Sandboxes VMs read and modify host files; update to 0.42.0.
1
Feeling sad about AI
Simon Willison argues developers disheartened by AI coding agents should move past existential crisis and refocus on broader engineering problems.
RTK reports token savings, but our cost benchmarks disagree
Quesma's $1,500 benchmark found RTK cuts reported token output but changes Claude Code and DeepSeek coding costs by only about 5% on Terminal-Bench 2.1.
8
Design Docs Are All You Need: An AI-native Machine-Learning Performance Tool
Researchers present SMART, an ML performance-modeling library regenerated by AI coding agents from natural-language design docs instead of code.
Putting models to the secure coding test: Plan vs default mode
Datadog Security Labs tested Sonnet 5, Composer 2.5, and GPT 5.5 to see if plan mode yields more secure code than default mode.