Hey there 👋 Yesterday the question was which coding agent your whole org should standardize on. Today the question is darker: what did you just plug into your build pipeline? This week researchers showed that a fake bug report can make your coding agent run a stranger’s code — on your machine, with your privileges. We spent six months tuning MCP for token cost and setup friction. The bill came due on something else entirely: trust. Here’s the twist that keeps this from being a doom post. The same week the flaw went mainstream, the industry started selling the fix. AWS shipped a control plane. Anthropic and Okta shipped real IAM for connectors. The MCP spec itself is hardening. MCP just went from plumbing to attack surface — and the patch is yours to ship. Five minutes. Let’s go.
The Big ThingA Fake Bug Report Can Hijack Your Coding Agent — And the Fix Lives in Your Harness, Not the Vendor’sTL;DR: Security researchers disclosed an attack class called Agentjacking: an attacker plants a crafted error event in your Sentry, and when a developer tells Claude Code, Cursor, or Codex to “go fix the open Sentry issues,” the agent reads the malicious payload and runs the attacker’s commands — with the developer’s own privileges. Sentry disclosed and acknowledged the same day, added a content filter for one payload string, and called the class “technically not defensible” at the platform layer. What actually changed. The mechanism is the verified story, and it’s an architecture problem, not a scary-AI story. MCP tool output is unauthenticated input — but the agent treats it as trusted system context. It can’t tell your guidance from a stranger’s payload. The entry point is a Sentry DSN, a public, write-only key that’s scrapable from browser JavaScript or GitHub. Anyone who has it can write a fake error event into your project. Your agent then reads that event as a real bug to fix and acts on it. Why this matters to your stack. This is the deployment-blocking flaw the whole MCP land-grab has been skating past. Every MCP server that returns externally-influenced data — issue trackers, ticketing, web fetch, email, logs — is a code-execution path the moment you let an agent auto-run shell or npx on what it reads. The unit of risk isn’t “a model.” It’s a connected tool that speaks to the model in the model’s own voice. Third thought. The scope numbers are loud, so handle them with gloves. Tenet Security and the Cloud Security Alliance report injectable DSNs in 2,388 organizations — 71 of them in the Tranco top-1M — and an 85% full-execution rate across 100+ consenting orgs in controlled tests, including one they call a “$250B company.” Those are vendor-reported scope claims, not independent fact — treat the victim counts as marketing math. The mechanism is the corroborated part (CSA’s research note, The Hacker News, Cybersecurity News, Pinggy’s breakdown, and Sentry’s own acknowledgment). Internalize the mechanism, discount the math. Ship it? ⚠️ Don’t pull your agents — patch your harness. Treat all MCP tool output as untrusted input. Keep a human-in-the-loop on shell, npx, and file-write. Scope your DSNs and rotate the public ones. Inventory which connected MCP servers return attacker-influenceable data. The number to remember isn’t the victim count — it’s that the patch is yours to ship, not Sentry’s. Sources: The Hacker News · Cloud Security Alliance · Tenet Security · Pinggy
Tour de Headlines🏗️ AWS is selling the agent control plane — the blast-radius container, priced. At Summit NYC on June 18, AWS bulked up Bedrock AgentCore: identity, observability, guardrails, knowledge connectors (org, web, paid), and production issue-finding. Read it against the Big Thing. The same week researchers showed agents will run attacker payloads, AWS is racing to sell the layer that contains the blast radius. The tell is AWS’s own line — “controls that scale as agents get more capable” — a polite way of saying capability is outrunning governance and they’re pricing the gap. The builder tension: standardize on a hyperscaler runtime (AgentCore, Vertex, Foundry) for the governance, or keep orchestration portable and bolt on your own observability. One caveat — this is summarized from the Summit roundup, so don’t assume any feature is GA. Treat availability as “announced,” not shipped.
Sources: AWS · Agent Harness 🔐 MCP just grew real enterprise IAM — and it’s an open extension, not a moat. Anthropic shipped Enterprise-Managed Authorization (EMA) on June 18: IT provisions MCP connectors once through the identity provider (Okta first), and employees inherit zero-touch access on first login — no per-user OAuth consent screens for security to chase. The non-obvious bit isn’t “Claude plus Okta.” It’s that EMA is an open MCP authorization extension — in the IETF OAuth working group since September 2025, in the MCP spec since November, declared stable June 18 — so your own internal MCP tools can adopt it too. This is MCP growing central provisioning and revoke, the direct answer to the trust gap above. It’s in beta — Team and Enterprise plans must apply, it’s not auto-on — and Okta is the first IdP, not the only one. Launch providers: Asana, Atlassian, Canva, Figma, Granola, Linear, Supabase, with Slack in progress.
Sources: Anthropic · Okta · TestingCatalog 👀 GPT-5.6 watch: a frontier coding model may drop next week — maybe. File this as a watch, because that’s all it is. Polymarket has it around 83% to ship June 22–28, OpenAI’s chief scientist called it a “meaningful leap,” and a “kindle-alpha” build flickered on Design Arena before getting pulled. Leaks point to roughly 1.5M context and stronger agentic coding — but read those as leaks and odds, not specs. There’s no date, no system card, and no API string from OpenAI as of today. The only verified facts here are the chief-scientist framing and the betting-market number; everything else is developer rumor. Builder takeaway: hold a benchmarking slot for next week, but don’t over-commit this week’s tooling decision until the system card actually lands.
Sources: TechTimes · Polymarket · Cryptopolitan
Sponsor Your agents are getting smarter. Is your team? RapportScore reads the human signals in every sales and customer call and scores how well your team actually connects — deterministic measurement, not vibes. See where rapport breaks before the deal does. See your team’s score → |
Tool of the Day🧰 Kimi K2.7-CodeAn open-weight 1T-parameter MoE coding model from Moonshot you can self-host — built for agentic tool use, so your agent’s tools run on weights you control instead of a vendor’s API. If you read the Big Thing and want the agent’s tool loop on your own hardware, this is the hedge. Kimi K2.7-Code is a coding-specialist open-weight model with 256K context, runs on vLLM, SGLang, or KTransformers, costs about $0.95 per million tokens hosted, and ships under a Modified-MIT license. The pitch is data sovereignty: self-host the weights and your code never leaves your walls. Now the honest catch, because this is the part the headlines skip. Every benchmark number — including the “81.1% vs Opus 4.8’s 76.4%” on MCP tool use — comes from Moonshot’s own suites. There were zero independent third-party scores at release. The “beats Opus on tool use” claim is real-but-self-graded, so pilot it on your own eval instead of headline-buying it. Two more flags: Modified-MIT means you should read the modification terms before commercial self-hosting, and the usual China data-law caveat applies for sensitive code. Try Kimi K2.7-Code →
Worth a Click- GLM-5.2 takes #1 open-weight on the Intelligence Index(Z.ai) — The third Chinese open-weight in three weeks — after MiniMax M3 and Kimi K2.7 — to claim a frontier-class agentic-coding result. Z.ai’s GLM-5.2 reportedly beats GPT-5.5 on several long-horizon coding benchmarks at about 1/6 the price. The pattern, not any single model, is the story: data-sovereignty hedges are now performance-competitive, not just compliance fallbacks. Index position is blog-cited (Artificial Analysis), and the China data-law caveat applies.
- MCP’s biggest revision ever is in release-candidate(Model Context Protocol) — Stateless core, Tasks for long-running work, MCP Apps for server-rendered UI, OAuth-aligned auth, and breaking changes — final ships July 28. If your stack depends on MCP, the next six weeks are the validation window. Test against the RC now; Tier-1 SDKs are expected to ship support inside it. “Stateless at the protocol layer” plus a formal deprecation policy means MCP is growing into enterprise infra — and the same injection surface from today’s lead is about to be re-plumbed mid-flight.
The real shift this week: MCP stopped being plumbing and became attack surface. We spent six months tuning it for token cost and setup friction. The reckoning came on trust. The discipline for the back half of 2026 isn’t “agents are dangerous, slow down.” It’s three moves: treat every connected tool as untrusted input, keep a human on the destructive actions, and centralize who-can-connect-what. Standardize on agents boldly. Govern the trust boundary like you mean it. The patch is yours to ship — not your vendor’s. Keep your exits warm. — The Agent Stack |
