|
Hey there 👋
Something worth sitting with this Sunday: the thing most likely to compromise your coding agent this year isn’t a hacker at a keyboard. It’s a picture.
All week the story climbed the stack — the coworker agent left the laptop (Thursday), became a two-horse race (Friday), and its engine got cheap and shockingly good at doing while getting shakier at knowing (Saturday). Today, look down at what the agent reads. Researchers just showed that one image committed to a repo can quietly turn your coding agent into a secrets-leaking tool — and your AI code reviewer waves it through, because it never opens the picture. The model you run matters less this weekend than the inputs you let it trust.
The Big Thing
Your AI code reviewer skips images. Attackers just noticed.
Researchers at UMKC’s ASSET group disclosed Ghostcommit this week — a supply-chain attack on AI-assisted development that hides its payload exactly where your review tools don’t look: inside an image.
Here’s the shape of it, no recipe attached. A pull request adds an AGENTS.md file — the convention file coding agents read automatically and treat as project policy. It reads like ordinary build hygiene and names no secret. It just points to an image in the repo, say docs/images/build-spec.png. The malicious instructions live in text rendered inside that PNG.
To a text-first code reviewer, an image is an opaque blob. The researchers note CodeRabbit’s default config excludes image files from review outright, and Bugbot returned no findings. So the pull request merges clean.
The trap springs later. In an unrelated session, a developer asks the agent for a routine feature. The agent reads the merged AGENTS.md, follows the pointer, opens your .env, and quietly emits its contents as an innocent-looking block of code. Trigger and payload are separated in time — which is exactly why nobody connects them.
The same team shipped a fix: a multimodal pull-request defender, a GitHub app that runs on a single 4GB GPU and — critically — runs an LLM pass over the images, not just the text.
Ship it? Treat agent inputs as untrusted code. This weekend: check whether your AI reviewer even parses referenced images — many exclude them by default, and that’s a blind spot, not a safe setting. Least-privilege your agent’s filesystem, because a coding agent that can read secrets in the same breath it edits code is the whole vulnerability. Put a multimodal reviewer in front of merges, and keep a human on anything that touches credentials. The lesson isn’t “AI review is unsafe.” It’s that an agent’s attack surface is everything it ingests — and images are inputs, too.
Sources: UMKC ASSET disclosure (asset-group.github.io); BleepingComputer and CyberSecurityNews (Jul 10–11). Attack behavior per the researchers; independent research, not a vendor claim.
Tour de Headlines
🪙 Meta just entered the cheap-engine race — from the vendor your shortlist skipped. On Jul 9, Meta shipped Muse Spark 1.1, its newest model built for agentic and coding work, and opened the Meta Model API in US public preview at $1.25 / $4.25 per million in/out tokens — roughly a quarter of flagship rates — with $20 in free credits. It’s multimodal, carries a 1M-token context, and does native tool use and computer control across apps. Saturday’s Grok 4.5 lead just got a new runner. One honest caveat: the coding and benchmark-parity claims are Meta’s own. So the real weekend move is to drop it into an existing agent loop behind your own eval and A/B the cost delta before you trust the leaderboard.
🛡️ Microsoft turned agents loose to defend its own cloud. The flip side of today’s Big Thing: in a Jul 8 security post and Jul 10 progress report, Microsoft detailed an internal multi-agent system that reasons across source code, identity config, network topology, and runtime state to surface chained vulnerabilities a single-layer scan misses — with engineers confirming most findings before anyone acts. Read the two together and the point lands: agents are both the new attack surface and a credible defense. It’s not a product; it’s a copyable pattern — many narrow agents, composite-risk reasoning, a human gate on remediation. The caveat worth stating: the hit-rate is Microsoft’s own number, and “agents reviewing agents” still needs that human in the loop.
🧭 OpenAI is killing its AI browser under a year in. OpenAI is sunsetting Atlas — shutdown around Aug 9 — and folding agentic browsing into the ChatGPT desktop app, now merging ChatGPT and Codex, plus a Chrome extension. The builder read: the standalone “AI browser” was a feature, not a product. Browsing becomes something your coworker-agent does, not a place you go. It fits the week’s arc cleanly — the agent keeps swallowing surfaces: the laptop, the category, the engine, now the browser. If you built a workflow on Atlas, map the migration this week.
|
Sponsor
You’re hardening what your agents read. Your sales calls are still unread.
Today’s whole issue is one instinct: stop trusting an input just because it looks clean. You’re auditing what your coding agent ingests. Now point that same instinct at the highest-stakes inputs in your business that no tool checks — your live sales and CS conversations. The discovery call that got misread. The deal where two people “aligned” on different things. The rapport that never formed — and closed-lost with no warning light. RapportScore reads the human signals in every call and email and scores how your team actually connects, so the misfires surface while you can still fix them. You wouldn’t merge a PR you never reviewed. Stop shipping revenue conversations unread.
See your team’s score →
|
Tool of the Day
🧰 Browser4
Give an agent a real, fast browser — without paying tokens for every field it reads. Free and open-source.
Fresh on GitHub this week, Browser4 hands an agent a “coroutine-safe” browser: an autonomous browse-and-act loop, plus ML-based field extraction that learns a page’s structure without spending model tokens on every parse, and a hybrid LLM/ML/SQL extraction path. Project-reported throughput runs to 100,000–200,000 complex page-visits per machine per day. The clean weekend build: point an agent at a real browser for scraping, monitoring, or QA loops and skip the per-token extraction bill. The throughput and “token-free extraction” numbers are the project’s own — so run it on one workflow and measure. And per today’s Big Thing, treat every page it visits as untrusted input too: sandbox it, and keep your secrets out of its reach.
Get Browser4 on GitHub →
Worth a Click
- AgentPrizm launched a governed memory layer for agents — persistent memory over REST and MCP, with confidence-weighted facts, validity windows, contradiction handling, container isolation, an audit receipt on every recall, and one-call GDPR right-to-forget with verifiable deletion. Memory is the quiet governance gap under every “coworker” agent; this makes recall reproducible and erasable. Vendor-reported, no independent test yet — but the right guardrail to be shopping for.
- The buy-side guardrail market matured in a single week — Citrix shipped an MCP Gateway to secure enterprise MCP access, and Codenotary’s AgentMon 3 added runtime security policies learned from agent behavior. Map your agents to an MCP access gateway and a runtime policy before you scale them, not after.
- Delight: the ex-GitHub CEO is rebuilding Git for agents, not humans — Thomas Dohmke opened a preview of Entire, regional Git mirroring so coding agents clone and fetch from nearby copies, cutting latency as their workflows run longer. The tell: even the person who ran GitHub thinks human-shaped Git is the wrong shape for agents. Early preview — read it as a signal, not a deployable.
The week’s real lesson isn’t a product — it’s where the risk moved. We spent all week routing doing to a cheap, capable, occasionally-wrong engine. Ghostcommit shows the other half: an agent’s attack surface is everything it ingests — an image in a repo, a convention file, a page it browses. Cheap autonomy just means more agents reading more untrusted inputs, faster. So the Sunday build isn’t a new coworker or a new model — it’s hardening the inputs: validate what the agent reads, least-privilege its access to secrets, put a multimodal reviewer in front of merges, keep a human on anything that acts. Rent the engine; harden the inputs.
Have a treat-your-inputs-as-untrusted weekend.
— Ace, for The Agent Stack
|
