Development

For a developer that surface starts in the working directory. Forever Security showed that a web page dropping an AGENTS.md into ~/Downloads was enough to hijack Codex (90% success with a benign payload) and, through a CLAUDE.md variant, to redirect Claude Code's API traffic in about half the runs. There is no CVE, and the vendors' advice is simply to run agents from a project directory. A trust-region paper explains why this works: agents follow unsafe instructions in README and TODO files 2.6x more often than in code or data. The extension that runs the agent is part of the surface too - a trojanized build of the official Claude Code extension sat in Cursor's marketplace for about 11 hours. The answer shipped in the same month: Copilot local sandboxing on Microsoft MXC went GA, restricting files, network and Git credentials under a policy the enterprise can require and the developer cannot weaken. The L2 bar moves accordingly: the sandbox is on by default, the agent starts in a project directory, and instruction files load only from the trusted project root.

The second story is routing, and it comes with a correction to our own advice. Last month we promoted System One decision models as cheap safety gates. In October the pattern got competitors - OpenAI's Decisions API in limited preview, Cloudflare's open-weight Clef - and Copilot Fusion made vendor auto-routing the baseline to beat. Then Datadog Security Labs showed counterfeit "policy" text steering a Jev-based injection classifier. A decision model is a filter, never the only gate. Auto-routing raises a quieter problem: Adversa's Copilot CLI injection chain exfiltrated a production `.env` file on one model half the time and was refused by two others, and with Auto the user cannot see which model ran. Since 63% of paid Copilot users already use auto model selection (GitHub's own data), the rule is simple: auto-route for cost, pin the model for security-sensitive runs.

Review and testing closed the month with numbers that cut both ways. The Harvard working paper on Jellyfish telemetry from 700+ firms found coding agents raised lines of code 30% and PRs 23% while resolved issues did not move, and review time grew 49%. More code, not more software - which makes review capacity the real constraint and justifies a security review agent on every PR (Claude Security, Codex Security, GitHub agentic autofix validated by re-running CodeQL). Veracode's vendor benchmark shows the first real gain in a year, from 56% to 62% average security pass rate, but even the best models at 73% fail one task in four. And the agent setup itself needs tests: INFUSE cut indirect-injection success from 58.2% to 14.3% with prompt-level hardening, while existing guard models helped little. Only a measurement on your own configuration tells you which of those you have.