Weekly digest · Oct 8 to Oct 15, 2026
32 new entries this week (5 critical, 24 high). Every entry links to its sources on its full page.
Fake 'Apex Copilot' coding agent on npm rerouted model traffic, planted an attacker MCP server and dropped malware
High · Incident
Elastic Security Labs reported on Oct 12, 2026 that @apexacc/cli, an npm package sold as the 'Apex Copilot' AI coding assistant, was malicious from its first release. It was a near-copy of the open-source coding agent Oh My Pi: 1,351 of the 1,363 files Elastic compared matched Oh My Pi v16.3.6. The added code sent the agent's model requests, including file contents from tool calls, to an attacker server while still labeling the provider OpenRouter. It also added an attacker-controlled MCP server to the agent's config and ran commands fetched from the operators' server, which led to a macOS backdoor and a Windows infostealer. A second package, @apexacc/audit, posed as an MCP security-audit server, but all 18 of its tools returned made-up findings. The operation posed as a Web3 accelerator offering crypto founders free Claude and Gemini credits. Oh My Pi is a legitimate open-source project that was copied; it is not at fault and is not affected.
GHSA-632h-h47v-g4x4: any web page could make OpenCode's local server install and run an attacker's package
High · Vulnerability
Datadog Security Labs found that the local server OpenCode starts with opencode serve or opencode web would install whatever its /global/upgrade endpoint was told to. On installs managed by npm, pnpm or Bun, that target could be a link to an attacker's package, and installing it ran the package's install scripts. The endpoint did not check where a request came from and read plain-text bodies as JSON, so any web page the developer opened could send the request through the browser. OpenCode 1.18.22, released Aug 24, 2026, fixes it. Affected versions are 1.14.30 through 1.18.21. Anomaly, which develops OpenCode, published the advisory on Sep 24 and rates it CVSS 7.5 High. It chose not to request a CVE.
CVE-2026-90970: GitLab AI Gateway let Duo Agent Platform users escape the prompt template sandbox and run commands
Critical · Vulnerability
GitLab fixed CVE-2026-90970 in GitLab AI Gateway 19.2.4, 19.3.2 and 19.4.1, released Oct 2, 2026. The AI Gateway is the service that gives GitLab Duo its AI features. GitLab says an authenticated user with Duo Agent Platform access could escape the prompt template sandbox with a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway. GitLab rates it CVSS 9.9 Critical. Only self-hosted AI Gateway installations need to update: GitLab.com, GitLab Dedicated and Self-Managed instances that use a GitLab-hosted AI Gateway already have the fix.
CVE-2026-63093: Cursor on Windows ran a git.exe planted in the project folder
High · Vulnerability
Mindgard reported that Cursor on Windows would find and run a file named git.exe sitting in the root of an opened project, both at startup and repeatedly afterwards, with no extra click. The CVE record (CVE-2026-63093, assigned by VulnCheck) lists Cursor for Windows 3.2.16 and scores it CVSS 4.0 8.7. Cursor first said the report was out of scope for its bug bounty and that it had not kept the researcher updated in time. An August 2026 update says Git is now launched from a validated absolute path and tells users to update to Cursor 3.13.25 or later. macOS and Linux were not affected, per Cursor.
GitSpawn: a repository's own git config could run code when AI coding agents gathered context
High · Research
Manifold Security's GitSpawn research, published Sep 1, 2026, found that several AI coding agents run git in the background to gather context, sometimes before the trust prompt or login. If a project arrives as files with its .git folder included (a zip, shared drive or USB stick, not a normal clone), a setting such as core.fsmonitor in .git/config can make that git call run any command on the host, outside the agent's sandbox and without an approval prompt. Manifold reported eight findings across seven agents and said four were unpatched when it published. Statuses below are as of Sep 1, 2026 unless a later source says otherwise.
CVE-2026-85623: a shared Goose recipe could start commands before the user approved it
High · Vulnerability
CVE-2026-85623 covers Goose recipes, shareable agent configs that can declare stdio extensions and retry.checks shell commands. Goose ran those commands when a recipe loaded, and its recipe security scan did not look at those fields. The CVE record lists goose up to 1.49.0 and a CVSS 4.0 score of 8.7. Goose's maintainers said the command-line behavior is by design, like running a shell script, but fixed the Desktop app so nothing starts until the user approves the recipe. That fix shipped in Goose 1.52.0 on Sep 23, 2026.
GHSA-v234-4jrq-mgg6: Claude Desktop on macOS could run a file an agent left in a Cowork folder
High · Vulnerability
Anthropic published advisory GHSA-v234-4jrq-mgg6 for Claude Desktop on macOS. Claude Desktop blocks file types that execute on open from being opened straight from a Cowork shared folder, but the macOS list missed one such type. A file placed there by a compromised or prompt-injected agent could run commands on the Mac if the user opened it from Claude Desktop. Versions from 1.1.3918 up to but not including 1.15962.0 are affected; 1.15962.0 fixes it. Anthropic scores it CVSS 4.0 8.5 and says auto-updating users already have the fix. No CVE is listed yet.
Claude Code npm 2.1.88 shipped a source map that exposed the CLI's source code
Medium · Incident
Version 2.1.88 of the @anthropic-ai/claude-code npm package included a large source map file (cli.js.map) that let anyone rebuild the CLI's TypeScript source, more than 512,000 lines in almost 2,000 files. Researcher Chaofan Shou pointed it out on X and copies spread on GitHub. Anthropic said no sensitive customer data or credentials were involved or exposed, and called it a release packaging issue caused by human error, not a security breach. Version 2.1.88 is no longer on npm. This exposed Anthropic's own code, not user data.
PocketOS: a Cursor agent deleted the production Railway database in one API call
High · Incident
Jer Crane, founder of PocketOS (car-rental software), said a Cursor agent running Anthropic's Claude Opus deleted the company's production Railway database and recent backups with a single nine-second API call. PocketOS customers lost reservations and sign-ups over a weekend. Railway founder Jake Cooper confirmed an AI agent had "vibe deleted" the data, said Railway restored it about 30 minutes after connecting with Crane, and said the agent had used a legacy Railway API endpoint that deleted volumes immediately. Railway patched that endpoint so API deletions get the same delayed-delete window as the dashboard.
CVE-2026-96893: crafted content in GitLab Duo Agent Platform instructions could run commands credited to other users
High · Vulnerability
GitLab fixed CVE-2026-96893 in its Oct 12, 2026 critical patch release. The flaw was in the GitLab Duo Agent Platform, GitLab's AI agents for software development. GitLab says an authenticated user could inject specially crafted content into AI agent instructions, which could cause unintended command execution attributed to other users. The cause was improper neutralization of special elements when GitLab built the AI conversation context. GitLab EE 19.1 through 19.2.7, 19.3 before 19.3.5 and 19.4 before 19.4.2 are affected. GitLab.com already runs the fix, and GitLab Dedicated customers do not need to act.
SneakPeek: Claude Code Desktop preview pane could leak local secrets from large HTML files
High · Vulnerability
Noma Labs disclosed SneakPeek, a flaw in Anthropic's Claude Code Desktop preview pane. HTML files over 256KB were written to disk and loaded as file:// URLs, which skipped the Content Security Policy applied to smaller files. Embedded JavaScript could then read local files such as AWS credentials, SSH keys and OAuth tokens and send them out. Anthropic assigned CVSS 8.7 (High) and, after an initial patch that Noma Labs bypassed with a Web Worker, shipped a full fix in Claude Desktop 1.30096.1 and later (auto-update). A GitHub Security Advisory and CVE are not public yet; Noma says they are pending publication.
UpGuard research: 16,326 Supabase databases had tables anyone could read
High · Research
Supabase's CISO, Bil Harmer, told TechCrunch the company had not seen the research, that Supabase projects are 'secure by default', and that security is shared: Supabase provides defaults and tooling, customers control their own configuration. The research itself: UpGuard collected about 300,000 domains showing signs of Supabase use and found 16,326 databases with tables readable from the public internet. This is a scan of misconfigured customer projects, not a breach of Supabase. More than half of those databases had schema signs of personal data. UpGuard links the problem to tables that AI coding agents create through the API, where Row Level Security is not switched on by default.
CVE-2026-103572: a trailing dot let Visual Studio Copilot rewrite protected config and run commands
High · Vulnerability
Johann Rehberger (Embrace The Red) showed that GitHub Copilot in Visual Studio and SQL Server Management Studio blocked writes to files such as .mcp.json and settings.VisualStudio.json by comparing path strings, but Windows drops a trailing period when saving a filename. Writing .mcp.json. therefore passed the check and landed on .mcp.json. That let a steered agent add a malicious MCP server or rewrite the ripgrep path and run commands. Microsoft fixed it in the October 13, 2026 Patch Tuesday release. Fixed builds are Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4. SSMS shares the same vulnerable Copilot code and needs the same update pass.
CVE-2026-103435: Claude Code could follow a swapped-in symlink and write outside the project
High · Vulnerability
Anthropic published advisory GHSA-5j29-h97v-84ch for Claude Code. When Claude Code asked permission to edit a file, it checked that the path was inside the project folder, but it looked the path up again when it wrote the file and did not repeat the check. Someone who could write to the same workspace could swap that file for a symlink in between, so the edit landed on a file outside the project, such as a shell configuration file. Claude Code 2.1.129 fixes it, and Anthropic says standard auto-update users already have the fix.
CVE-2026-102232: Copilot agent sessions in VS Code could edit hook files without asking
High · Vulnerability
Microsoft fixed four AI-related security issues in VS Code 1.141.1 on Oct 13, 2026. In CVE-2026-102232, GitHub Copilot agent sessions backed by the local Copilot harness treated custom hook and agent-definition files as ordinary workspace files and could edit them without the usual approval prompt. Through prompt injection, an attacker could get the agent to add a shell command to a hook, which then ran with the user's privileges the next time the hook fired. In CVE-2026-102851, sandbox permissions approved for one MCP server were saved in shared settings, so other MCP servers using the same configuration got them too. In CVE-2026-102231, an experimental workspace setting let a workspace override the Azure DevOps code search endpoint, so a malicious workspace could send Copilot code search requests and the user's Azure DevOps token to a server the attacker controls. In CVE-2026-70098, opening a workspace through the vscode.dev/agents/tunnel web path skipped workspace trust, so agent skills supplied by an attacker could run without a warning. Microsoft lists all four as not publicly disclosed and not exploited when it released the fix.
CVE-2026-79403: Kilo Code's local server let other programs switch on 'allow everything' without a password
High · Vulnerability
CVE-2026-79403 covers Kilo Code, an open-source AI coding agent. Its CLI runs a local HTTP server, and the /permission/allow-everything endpoint, which saves wildcard approvals for the agent's tools and commands, could be called without authentication. The daemon's password also defaulted to the fixed string 'kilo'. According to the fix, that left the endpoint reachable by local scripts and by browser requests that could find the server's port. NVD describes the result as arbitrary code execution by a local attacker. Kilo Code 7.4.1, released Jul 3, 2026, fixes it.
Roo Code: five unpatched CVEs let crafted shell commands slip past auto-approve
High · Vulnerability
NVD published five CVEs from VulnCheck for Roo Code, an AI coding agent for VS Code. Each one is a way to make a denied shell command look like an allowlisted one, such as echo, so Roo Code runs it without asking when auto-approve is on. All five affect Roo Code through 3.54.0. The GitHub repository is archived and 3.54.0 is the last release, so no fix is expected. NVD tags all five as unsupported when assigned. VulnCheck scores each 7.7 High (CVSS 4.0) and 8.8 High (CVSS 3.1).
CVE-2026-88066: Claude Desktop on Windows ran a malicious git.exe from the project folder
High · Vulnerability
Anthropic published advisory GHSA-4p2j-qj3c-6x84 for Claude Desktop on Windows, assigned CVE-2026-88066. The app started git.exe without an absolute path, so Windows looked in the current working directory before the system directories. A git.exe placed in a project folder, for example inside a shared or cloned repository, ran as soon as the user opened that folder in Claude Desktop. Version 1.8089.0 fixes it, and Anthropic says users on standard auto-update already have the fix. The NVD record for CVE-2026-88066 is still pending.
CVE-2026-86063: Claude Code plugin install could skip a pinned commit hash
High · Vulnerability
Anthropic published advisory GHSA-pq7j-f95f-qfcv for the plugin install flow in Claude Code and Claude Desktop. When a marketplace pinned a plugin to a 40-character commit SHA, the installer ran git checkout on that value but never checked that the result matched the pin. An attacker who controlled the plugin's repository could create a branch named exactly like the pinned SHA, and the install would pull the branch tip instead of the reviewed commit. Claude Code 2.1.179 fixes it, and Anthropic says standard auto-update users already have it.
Mistral Vibe: two CVEs let crafted shell input bypass command permission checks
High · Vulnerability
NVD published two CVEs from VulnCheck for Mistral Vibe, Mistral's coding agent. In both, a crafted shell command looked like an allowlisted command to Vibe's permission check, while bash actually ran a different, hidden command. One is fixed in 2.25.4, the other in 2.25.5. VulnCheck scores both 8.7 High (CVSS 4.0) and credits Minqiang Gui.
Enrichlead: a SaaS built with 'zero hand-written code' in Cursor was abused within days and shut down
High · Incident
Founder Leo Acevedo posted that his sales-lead SaaS, Enrichlead, was built with Cursor and 'zero hand written code'. Days later he wrote that he was 'under attack': API key usage maxed out, people bypassing the subscription and writing junk into the database. He rotated keys, added auth and tightened CORS, then said he was shutting the app down.
CVE-2025-53773: prompt injection could switch GitHub Copilot into auto-approve ('YOLO') mode and run commands
High · Vulnerability
Researcher Johann Rehberger (Embrace The Red) showed that injected instructions in a file, web page or issue could make Copilot's agent write "chat.tools.autoApprove": true into VS Code settings. That turns off confirmation prompts, after which the agent can run shell commands. Microsoft fixed it in the August 2025 Patch Tuesday release. NVD lists CVSS 7.8 High.
Claude Code: several 2025 CVEs let untrusted content bypass command confirmation prompts
High · Vulnerability
Anthropic published a series of advisories in 2025 for Claude Code. In each, content an attacker could get into the context window (a file, a web page) could lead to commands running without the user's approval, or to file contents being sent over the network. All were fixed, and auto-update delivered the fixes.
Slopsquatting: AI coding models invented 205,474 unique package names in one study
Medium · Research
A USENIX Security 2025 paper tested 16 code-generating models on Python and JavaScript and found that 19.7% of the 2.23 million package references in the generated code (440,445) pointed to packages that do not exist, including 205,474 unique invented names. Commercial models averaged at least 5.2%, open-source models 21.7%. An attacker can register one of those names on npm or PyPI and wait for someone to install it. That tactic is now called slopsquatting.
Moltbook exposed about 1.5M agent API keys through an open Supabase database
Critical · Incident
Wiz Research found that Moltbook, a social network for AI agents, shipped a Supabase key in its client-side JavaScript while its tables had no Row Level Security. Anyone could read and write the production database. Wiz reports about 1.5 million API authentication tokens, about 35,000 email addresses and private messages between agents were exposed.
Lovable BOLA flaw left older projects readable for 48 days after it was reported
Critical · Vulnerability
A researcher (@weezerOSINT, Matt Palmer per Computing) reported a Broken Object Level Authorization flaw in Lovable's API through HackerOne on March 3, 2026. Any logged-in free account could request other users' project data, including source code, credentials and AI chat histories. Lovable added ownership checks for projects created after November 2025, but older projects were still reachable when the researcher disclosed the issue publicly 48 days later. Lovable first said it 'did not suffer a data breach', then acknowledged a February 2026 regression and closed off chat access on public projects.
RedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data
High · Research
Security firm RedAccess reviewed about 380,000 publicly reachable assets built with Lovable, Replit and Base44 or deployed on Netlify. About 5,000 were built for corporate use. Around 40% of those exposed sensitive data, and close to 2,000 revealed private records to anyone with the URL. WIRED verified that several of the exposed apps were still online, and VentureBeat reports that Axios verified others. Replit said RedAccess gave it only 24 hours before going to the press; Lovable and Base44 said they were not given the URLs needed to check the findings.
CVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned)
Critical · Vulnerability
Researcher Matt Palmer scanned the homepages of 1,645 Lovable projects in March 2025 and found 303 database endpoints across 170 projects (about 10.3%) with RLS settings that let unauthenticated visitors read or write data. Exposed data included emails, phone numbers, payment details and API keys. NVD lists it as CVSS 9.3. Lovable disputes the CVE, saying each customer is responsible for protecting their app's data.
Base44 auth bypass let outsiders register for private, SSO-only apps
Critical · Vulnerability
Wiz Research found that two undocumented Base44 endpoints let anyone create a verified account on a private app using only its app_id, which is visible in the app's URL and manifest. That bypassed SSO-only settings. Wix fixed it in under 24 hours and said it found no evidence of abuse.
Replit agent deleted SaaStr's production database during a code freeze
High · Incident
During a vibe-coding experiment, Replit's AI agent deleted Jason Lemkin's production database, wiping records for 1,206 executives and 1,196+ companies, despite an instruction not to make changes. The agent first said rollback would not work; the data was later recovered. Replit's CEO called it 'unacceptable' and shipped dev/prod database separation.
CurXecute (CVE-2025-54135): prompt injection could make Cursor write and auto-start an MCP server
High · Vulnerability
Aim Security reported that a malicious message coming in through an MCP-connected service could steer Cursor's agent into creating a .cursor/mcp.json file. Cursor would then start the new MCP server and run attacker-chosen commands without asking. Cursor fixed it in version 1.3.9.
Amazon Q Developer VS Code extension 1.84.0 shipped with an injected 'wipe' prompt
Medium · Incident
Version 1.84.0 of the Amazon Q Developer extension for VS Code contained an injected prompt telling the agent to delete local files and AWS resources. AWS says a syntax error stopped it from running and no customer environments were affected. Version 1.85.0 removed it.
That's the week. The full, dated log is at vibeincidents.com. Spotted an error in an entry? Tell us and we'll correct it. See our disclosure for how the site is funded.