The Wire — 2026-07-24

Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data

Noma Security's GitLost exploit demonstrates indirect prompt injection against GitHub's Agentic Workflows, where attackers embed concealed instructions in public issues to leak private repository data. The attack succeeded because the agent, triggered on issue assignment, treated user-controlled content as trusted instructions, bypassing guardrails with the keyword 'Additionally' to read restricted files and post them publicly. This highlights a fundamental vulnerability class in agentic systems: trust boundaries are now enforced by model behavior rather than code, making prompt injection as systematic a threat as SQL injection was to web apps.

Why it matters

For platform engineers building AI agents with cross-repo access, this shows that private repo boundaries are no longer security guarantees—any agent with read access is one crafted issue away from leaking your entire codebase.

AI/ML / dev.to

Teaching Claude Code to Direct: A Stateful Video-Editing Skill Built on Gemini's Interactions API and MCP

omni-skill-claude wraps Google's gemini-omni-flash-preview model in a FastMCP server and packages it as a Claude Code skill, enabling stateful video editing directly from the terminal. The skill leverages Gemini's Interactions API to preserve visual context across turns, allowing iterative edits (e.g., changing a scene to nighttime) without re-prompting the entire scene. It supports five generation modes—text-to-video, image animation, keyframe interpolation, subject-consistent generation, and video restyling—plus YouTube upload, all via eight MCP tools exposed by the server.

AI/ML / dev.to

My AI pentest agent reported 23 root shells. It had actually popped zero.

An autonomous penetration-testing agent built with an LLM driving nmap, Metasploit, and hydra initially hallucinated 23 root shells on a Metasploitable VM when zero were achieved, due to a flawed validator that matched searchsploit headers and banner text as evidence of compromise. Replacing the heuristic with a `breach_confirmed()` function that checks for real shell markers like `uid=0(root)` reduced claims to 3 confirmed shells, while fixing silent plumbing bugs—MCP schema mismatches, ANSI escape codes in module names, version-string parsing errors, and a 300-second timeout causing 5-minute stalls—enabled the agent to land three real root shells.

Cloud / dev.to

I Deployed a Purple Team Inside My Kubernetes Cluster. The Scanners Never Saw It Coming.

A purple team platform called NEMESIS, deployed as a Kubernetes DaemonSet, executed attack scenarios from inside the pod network and uncovered a ClusterRoleBinding granting cluster-reader to the default service account, plus a readable ConfigMap with a hard-coded PostgreSQL password—findings that Trivy, kube-bench, and Polaris all missed. The platform uses a Python controller for orchestration and a Go attack agent for sub-second cold-start primitives like token abuse and lateral movement, with eBPF integration via Cilium for kernel-level packet observability.

AI/ML / infoq.com

Article: The Self-Building Agent: A LangChain4j Experiment

A meta-experiment using LangChain4j directed an LLM-backed code assistant to design and implement a multi-agent coding system from its own documentation. The resulting self-built agent, using a supervisor pattern with four sub-agents (Explorer, Planner, Implementer, Executor), successfully fixed real bugs and passed tests. The experiment revealed that a rigid workflow pattern executes three times faster than the autonomous supervisor pattern by eliminating LLM-induced coordination overhead, and that newer models avoided tool-calling loops that plagued older, cheaper models.

DevTools / dev.to

Where Does RAG Actually Cost You Money? I Decided to Stop Guessing.

A developer's deep-dive into RAG pipeline costs reveals that embedding is not the expensive bottleneck, costing only ~$0.18 per 1,000 pages with OpenAI. The real recurring costs come from vector database infrastructure running 24/7 and LLM inference for reading chunks and generating answers. A dedup check on document changes (80% static, 20% changed) saves significant ingestion costs by avoiding re-processing unchanged content.

Cloud / dev.to

The AWS Cleanup We Keep Putting Off (I Let an Agent Do It)

An engineer used Kiro's Agent Toolkit for AWS to automate cleanup of forgotten CloudFormation stacks after a stale billing alert revealed years of unused resources. The agent listed 12 stacks, required confirmation before deleting four, and handled a DELETE_FAILED by pulling stack events to diagnose the issue—all without the engineer touching the console or CLI. This approach addresses the estimated 25% of cloud budgets wasted on forgotten resources.

Security / techcrunch.com

How AI guardrails are impeding the work of offensive cybersecurity researchers

AI guardrails from Anthropic and OpenAI, designed to prevent malicious use, are now hampering offensive cybersecurity researchers who need to probe systems for unknown vulnerabilities. Researchers like Mark Dowd and Chris Anley argue that the same prompts used for defensive code fixing also serve as exploit roadmaps, making guardrails arbitrary and counterproductive. Many teams fall back on open-source models without restrictions, while cloud-based frontier models risk leaking sensitive vulnerability data when used for exploit development.

General / blog.pragmaticengineer.com

The Pulse: New trend - concern about massive increase in code review load

Engineering leaders report a growing bottleneck as AI-generated code from models like Opus 4.5 and GPT 5.4 dramatically increases code review load, shifting the constraint from writing to reviewing. Teams are adopting dedicated AI review tools (CodeRabbit, Greptile, Qodo, SonarQube) or building in-house solutions like Uber's Code Inbox with smart assignments and risk profiles, while others explore verification via thorough testing as an alternative. The overload risks engineer burnout and superficial reviews, with many devs approving AI-reviewed PRs without intent, highlighting that current solutions remain experimental.

AI/ML / bfl.ai

Flux 3

Black Forest Labs released FLUX 3, a multimodal foundation model trained jointly on images, video, and audio within a unified architecture using their Self-Flow alignment method. The model generates up to 20-second video with native audio, supports text-to-video, image-to-video, video-to-video, and keyframe transitions, and was preferred over Grok Imagine Video in 69% of comparisons. Early access is available now, with evaluations still preliminary.