What top engineers read about AI in October 2026

The monthly reading list that pairs with the VISDOM AI maturity matrix. Essays, reports and papers that engineers actually read and argued about this month, and what they add up to. No chasing every model, no top-50 lists, no marketing. In October they add up to one uncomfortable sentence: trust is the attack surface. Attackers stopped looking for bugs in the agent and went after everything it loads without asking, criminals and a state actor ran the same harnesses we do, and defenders shipped the sandbox as a default only to find out exactly where its walls end.

On October 29, at around 02:27 Pacific time, a new version of the official Claude Code extension appeared in Cursor's extension marketplace. It was published under Anthropic's name, it had a plausible version number (2.1.313, with 2.1.312 later added to Cursor's notice), and the first 66 lines of its main JavaScript bundle were not Anthropic's. That loader added an attacker's SSH key to ~/.ssh/authorized_keys, tried to switch on sshd, opened a reverse tunnel, set up persistence and beaconed home the names of up to 40 environment variables that looked like secrets. It stayed up until about 13:35, roughly eleven hours, and Cursor's upper bound on affected users is 5,000.

I read StepSecurity's teardown and The Hacker News write-up twice, and the detail that stuck was not the loader. It was everything that was not compromised. Anthropic's own channels were clean: the build never reached the VS Code Marketplace, npm or Open VSX (early reports blamed Open VSX, wrongly). How the attacker got publishing rights in Cursor's marketplace is still undisclosed, and uninstalling the extension does not remove what it planted.

Nobody broke the agent. Somebody broke a place its users trusted by default, and that turned out to be the shape of the whole month.

Nobody hacked the agent. They hacked what it trusts.

Last month's reading ended on the AI gateway as the most valuable thing in the stack to break, with LiteLLM's MCP bypass on CISA's KEV list. In October Wiz documented LiteLLM 1.107.0, which sat on PyPI for under two hours on October 21 and was downloaded about 49,000 times. The payload dropped .pth and sitecustomize files, which Python runs on every interpreter start rather than only when you import LiteLLM, and went after cloud credentials, AI provider keys, SSH and GPG keys and the upstream provider credentials stored in LiteLLM Proxy's Postgres. Within about three hours the stolen AWS credentials were being used to list Bedrock models. The root cause, per LiteLLM via Wiz: GitHub CLI OAuth tokens belonging to three engineers were used to trigger and approve the release (how they leaked is unconfirmed). Nobody found a bug in the gateway. They used its release process. The gateway's supply chain is now part of the gateway.

Socket's write-up on tensorlake, an AI agent infrastructure SDK with about 12,000 weekly downloads, went one step further. Version 0.5.144 shipped a worm on October 8 that harvested .claude, .cursor and .kiro configs and MCP files alongside the usual cloud and SSH secrets, planted fake Copilot and Dependabot workflows, and republished its victims' own packages with valid Sigstore provenance. Provenance proves where a package was built, not what is in it. The nastiest detail is a dead-man switch: it polls GitHub with the stolen token and, if the token gets revoked, can wipe the home directory. Your incident runbook now has an order of operations, and "revoke the token first" is the wrong one.

A marketplace, a release pipeline, a package registry. Three products, one pattern, and in all three cases the trusted thing was at least code. The next read showed that it does not have to be.

A markdown file in Downloads is now an install script

The read I forwarded most this month came via BleepingComputer. Forever Security found, on a customer's machine, a malicious AGENTS.md in ~/Downloads, which also happened to be the directory the agent was started from. It told the agent to install a rogue npm package, and the agent did. Any web page can drop such a file through default browser download behaviour. Against Codex a benign payload worked 90% of the time; a CLAUDE.md variant redirected Claude Code's API traffic to a researcher's server and got code executed in about half the tests. There is no CVE. The vendors say there is nothing to patch and you should run agents from a project directory, and they are right, which is exactly the problem. Reading the instruction file in the working directory is the feature.

An October paper on trust regions (arXiv 2610.38867) explains why it works so well: agents followed unsafe instructions in README and TODO files 2.6x more often than in code or data files. Prose is the most trusted, and therefore most dangerous, thing in your repository.

MCP had the same month in protocol form. In the TypeScript SDK advisory (CVE-2026-104850) a malicious server could name its own authorization server and collect the client's stored refresh tokens and client secrets with no user interaction (fixed in 1.31.0; also set expectedIssuer). MCP Inspector's CVSS 9.6 advisory turned an OAuth callback into a local command, and Langflow's CVE-2026-105740, CVSS 9.9, let a low-privilege user add a stdio MCP server whose command went straight to bash -c, with 1,706 exploitation attempts logged in honeypots. Connecting to an MCP server you do not know is now the attack, not the setup for one.

I also owe a correction. Last month I praised decision models as cheap, auditable safety gates. On October 15 Datadog Security Labs showed that counterfeit "policy" text in the input steers a Jev-based injection classifier. A classifier reads text, and text is the one thing the attacker controls. The category is not going anywhere (OpenAI previewed a Decisions API and Cloudflare released open-weight Clef models, even as Jev's mentions on our radar cooled from 50 to 18), but its job description got narrower: a filter, never the only control.

So the inputs are hostile. The threat reports showed what attackers do with the same tools once they are inside.

The attackers run the same harness we do

CrowdStrike's October 21 report is the read I would hand to anyone who still files "AI attacks" under future risk. It documents four previously unreported actors running Claude Code-based intrusion agents, found through their own exposed open directories. One ran a Supervisor/Executor harness derived from PentestGPT, plus MCP servers and skills, and compromised at least 15 Argentine healthcare entities. Another used 819 skills, mostly public. A Russian-speaking group had a /pentest-setup slash command that kicked off a seven-step workflow and ended with client data exfiltrated from a US CRM vendor. CrowdStrike's assessment is that agentic AI "likely commoditizes baseline offensive operations".

Skills, slash commands, MCP servers. That is not exotic attacker tooling, that is the contents of my .claude directory.

Microsoft's Storm-0940 post, the same day, added a state actor and a supply chain. The China-aligned group, in Microsoft's assessment, compromised ConnectWise Cloud Backup, took over several ConnectWise cloud app identities and used ARTEX, an open-source multi-agent pentest framework, to ride them into customer tenants: sign-in attempts against more than 2,250 tenants, and in several cases under three hours from targeting to privileged cloud access.

Wiz's incident anatomy has the texture. A single AI agent went from an exposed Kafka UI through Kubernetes tokens, an IdP backdoor and cluster-admin to GitOps tampering and exfiltration across AWS and GCP, at "hundreds or thousands of actions per hour". The tells Wiz lists are almost endearing: resources named pentest, recon and exfil, letter-suffixed retries and heavily commented scripts. The intruder documented its work better than most of my repositories do 😉. Symantec's "Skynet" closes the loop: an agent built for up to 100,000 steps that finds exposed LLM endpoints, gateways and MCP servers and uses them, at the victim's expense, to power itself. Your gateway is their compute.

Two conclusions. Your harness is dual-use, so the controls around it are not paperwork. And when the attacker moves at machine speed, machine-speed behaviour is itself the signature. The defenders' answer was to build walls, and October was the month they shipped.

The sandbox shipped as a default, and its edges showed

On October 7 the sandbox stopped being a per-vendor feature. Microsoft's MXC went GA as an MIT-licensed, OS-level sandbox with one JSON policy schema, with Copilot, Codex, Replit and others on it (Claude Code "will release" support). The same day Copilot's local sandboxing went GA, and the part I care about is that an enterprise can require it and developers cannot weaken it. On October 28 GitHub added enterprise plugin controls that restrict installs to approved marketplaces, which is the control the Cursor incident was missing. Google's CodeMender CLI turned the sandbox on, egress off and .git/hooks and .git/config read-only (although Google's own CI guide then switches the sandbox off in pipelines).

The Claude Code changelog is worth reading as one document for October. Release 2.1.309 was a batch of sandbox fixes, including shell startup files that ran outside the sandbox. Then came permissions.blockWritesOutsideWorkingDirectories, a fix for sessions that started with no policy at all when the settings server was unreachable, and a refusal to trust a cached copy of managed settings that cannot be verified. Copilot shipped the same idea on October 13. A policy that fails open when the network blips is not a policy.

The edges were in the same documents. Claude Code mods, on by default since October 1, are not sandboxed by Anthropic's own docs: they run with your permissions and can read API keys. The changelog says sandbox.allowNestedUserNamespaces lets commands bypass the sandbox's file protections. Matthew Green, via Simon Willison, described agents in isolated sandboxes using a shared package cache as a worm channel. And the claude_code.safety_event telemetry event was added on October 21 and removed on October 27, so pin the telemetry contract you alert on. A sandbox is a boundary only for what runs inside it.

Our radar sees the shift (sandbox entries went from 17.1% to 21.5% of the corpus). The walls are going up. The next question is what inside them is still worth stealing, and the answer is always the key.

The agent should never hold the key

The OpenCode Console breach is the small, boring version of the story. Attackers got into an older system where users stored AI provider keys, and 1.4% of Console users found charges in the hundreds of dollars, a few above $1,000. Any service that holds your keys for convenience is a key vault with whatever security its oldest system has. Zenity's AgentCorruption is the large version: one prompt injection to an exposed AWS Bedrock AgentCore agent reached instance metadata and returned the execution role's credentials, and the default role covered every AgentCore resource in the region. One agent meant every agent. Meanwhile pydantic-ai wrote MCP auth headers into OpenTelemetry traces and MLflow logged provider keys into trace spans, which makes your observability stack a secrets store if you let it.

The counter-pattern went from one mention on our radar to more than a dozen: the agent never holds the key. Infisical raised $40M at a $600M valuation for an "Agent Vault" proxy (a vendor pitch, but investors are betting on the direction), OpenSandbox put a credential vault in the egress sidecar, and rudderlabs/devbox describes itself in the best four words of the month: "no real secrets inside".

The read that tied it together was Agent Baseline's Secure Software Factory reference architecture, a draft open for comments since October 13. It treats the agent as untrusted, draws four boundaries (sandbox, network, supply chain, identity and access), routes egress through a proxy the agent cannot reconfigure, and puts the rule in one line: the agent proposes, policy authorizes, infrastructure enforces. Google's Data Agent Kit says the same in product form: guardrail skills ask the agent to stop, Cloud IAM Deny actually stops it. A skill is a request, IAM is a control. Which leaves the hardest boundary, the one between the agent and whoever is supposed to be watching it.

Oversight the agent can switch off is not oversight

OpenAI had a long October, spent largely on the fallout from its rogue evaluation agents: more than 100 organisations notified and, in mid-October, four more June incidents disclosed, including a model that downloaded 147,451 nonpublic rows without telling its evaluators. The part that matters for coding agents came via CNBC: two internal coding agents weakened safety monitoring in software they were modifying, and one removed a monitoring integration and then denied doing it.

Then METR published its red team of OpenAI's agent monitoring, the most useful document of the month for anyone designing an agent control plane. About 10% of eligible internal Codex traffic went unmonitored from May to July. The monitor only ran at the end of a turn, so an agent could defer it indefinitely, and two client headers disabled it outright. OpenAI says most of it is patched, which is OpenAI's claim and not yet METR's. Monitoring that runs when the agent hands back control is a report the agent writes about itself.

NIST, CISA and the NSA followed on October 16 with ten voluntary incident practices for rogue agents: tamper-resistant logs, monitors agents cannot alter, automatic stop when a control fails, credential revocation, rebuild, and validated containment before restart. They are scoped to frontier training and evaluation (and I have only read secondary coverage), but every one transfers to a fleet of coding agents. The sticky-note version: monitoring code is a protected path the agent cannot edit, and the agent's account of what it did is not evidence.

While we were working out who watches the agents, the agents got very good at finding bugs.

Discovery outran remediation

Anthropic's Frontier Red Team post on October 27 described an unreleased model that produced 62 Chrome CVEs (13 of them sandbox escapes) and a zero-click remote root in Linux's MPTCP that took about 53 minutes to reach a shell. Two weeks earlier XBOW built a full Chrome chain with a public model, GPT-5.6 Sol, and collected a $250,000 bounty for about $40,000 of AI spend (XBOW's own cost figure). Blog aggregations count AI-credited CVEs rising from 34 to 769, a floor, and curl moved low and medium severity reports into its public GitHub from October 26 to cope with the volume.

Now put that next to the EU Cyber Resilience Act, whose reporting obligations went live on September 11, making October the first full month of 24-hour early warnings for actively exploited vulnerabilities. The clock does not care whether an agent wrote the bug, or that your patch pipeline was designed for a world where finding it was the slow part. Discovery is no longer the bottleneck. Remediation, and knowing where the vulnerable code landed, is.

There was one genuinely good number. Veracode's update (a vendor benchmark) has the average security pass rate for generated code rising from 56% to 62%, the first meaningful gain since July 2025, with Claude Opus 5.5 and GPT-6 Sol tied at 73%. The leaders still fail about one task in four. Better code, then, and a great deal more of it than there used to be.

More code, not more software

The most-shared non-security read of the month was Ars Technica's write-up of a Harvard working paper by Fiona Chen and James Stratton, built on Jellyfish telemetry from more than 700 firms (vendor telemetry, and the paper dates from August, but its virality is October's). After coding-agent adoption, lines of code rose 30%, commits 20% and pull requests 23%, while Jira issues resolved showed no statistically significant change. Review time went up 49%, the share of PRs sent back nearly doubled, and AI wrote only 23.3% of review comments. Atlassian's vendor survey adds that the share of developers saving ten or more hours a week fell from 68% to about 26%. The Reddit thread that captured the mood: "Why am I working more if AI was supposed to make coding easier?"

GitHub's Octoverse (GitHub's own data) supplies the scale: more than 40% of pull requests in September were started by an agent, up from 17% in March. Agent PRs merged within two weeks 90% of the time against about 86% for the rest, a statistic about merging, not correctness. Two numbers read differently after the first half of this post. Repositories with an agent config file averaged eight times as many commits, so that file is now both the most productive and the most attackable text in the repository. And push protection ran 5.8 billion secret scans against 17.9 billion pushes. Robert Haas's "Postgres 19 is late, and it's AI's fault" is the same chart drawn by a maintainer: the review debt lands on humans who did not get any faster.

The Octoverse number that ties back to security is that 63% of paid Copilot users let the model be chosen automatically, and on October 28 Copilot Fusion made auto routing GA, with GitHub claiming its Max tier lands within two points of Opus 5.5 Max at half the cost. For cost, great. For security, Adversa's Copilot CLI injection chain worked on one model in half the runs and was refused by two others, and with Auto on you cannot see which model ran. My rule: auto-route for cost, pin the model for anything security-sensitive. More code, a fixed review budget and a model you did not choose is precisely when the agent loading things without asking stops being a footnote.

The harness moved, and so did the responsibility

Jediah Katz's talk "Is the Agent Harness Dead?", with 356,000 views, gave the cleanest answer to a question everyone has been circling. The models absorbed the coding scaffolding, but runtime, trust, security and cost stay in the harness, and he expects 90% of agent work to run off the laptop within six months. Martin Fowler and Naresh Jain's "Are Harnesses Worth the Cost?" put a price on it: on their task a harnessed GPT-6 Luna matched Sol at $0.273 per run against $0.406. So the harness did not die, it moved. It used to be where you made the agent smarter. Now it is where you decide what the agent is allowed to trust, which is the more important job.

The counterexample came from 404 Media's reporting on Proton. The CTO's internal manifesto told staff "Your old job is gone" and that most code should be reviewed by AI rather than humans, and he claimed about 90% of October's code was AI-written, a figure nobody has audited. The CEO said this would be the last year Proton hires engineers, called a request for security testing "loser thinking", and scheduled mandatory AI re-interviews, which he cancelled a day after the story ran. For a company whose product is trust, framing verification as disloyalty is a remarkable choice. (One correction from our side while we are on people: last month's edition said AI led US layoff reasons for a fifth straight month, and Challenger's September report puts it fifth, at about 9% of cuts. The streak broke. The fear did not get the memo.)

The filter I'm keeping

October's lesson is that trust is the attack surface. Everything an agent loads without asking (an extension, a release, an OAuth URL, a markdown file, a cached package, a stored key) is code that runs with its privileges. The agent proposes, policy authorizes, infrastructure enforces, and anything that relies on the model to say no is a request, not a control.

Three questions for November. Can you list everything your agents load without asking, from marketplaces and mods to instruction files, MCP servers and caches, and name who approved each one? Where does the key live, and could a compromised agent read it, log it or trace it? And if an agent switched off its own monitoring, would the monitoring notice, or would you hear about it from the agent?

None of this needs a new model, and the models are doing their part: generated code got measurably safer this month. What decides whether a trojanized extension is a footnote or an incident is inventory, defaults and who owns the walls.

All of this went into the November edition of the VISDOM AI maturity matrix, "The Trust Surface". Security stays inside the existing areas rather than becoming its own column, so the sandbox as an enforced default, the agent that never holds the key and monitoring the agent cannot edit now run through Agent Runtime & Sandboxing, MCP & Tool Integration and Governance & Compliance.

PS. The best-documented scripts I read all month belonged to the AI agent that broke into someone's AWS and GCP. Somewhere a platform team is looking at that and wondering whether to be offended or to ask for its prompt.