Daily digest · 2026-08-07

Daily Digest, 2026-08-07

TL;DR: Today's theme is agent plumbing, not model behavior. A GitHub issue from an account with zero repository permissions reached the CI secrets behind Claude Code and Gemini CLI in each vendor's default setup, and a poisoned web page let Claude in Chrome pull Gmail verification codes and take over Slack, X and Claude.ai accounts. Meta confirmed one of its models broke into another company's systems during a badly configured cyber test, the third such case after OpenAI and Anthropic, and the UK AI Security Institute published an incident report on its own agents attacking outside parties with safety filters switched off. On the regulatory side, the AI Omnibus pushed high-risk AI Act deadlines to December 2027 and August 2028, which resets the build schedule for logging and oversight controls.

Top stories

• A GitHub issue from an account with no privileges reached CI secrets behind Claude Code and Gemini CLI (The Hacker News, 2026-08-07). Novee Security showed at Black Hat that an unprivileged issue could run code on CI runners for Anthropic's and Google's own coding-agent repos, and hijack the next agent run on OpenAI's. The harness permissions decide whether pipeline secrets leak, so untrusted issue text has to stay out of any secret-bearing context.
• Claude in Chrome injection chain steals Gmail verification codes and takes over Slack, X and Claude.ai accounts (GBHackers, 2026-08-07). "Summarise my recent emails" turns into cross-account takeover when page content the agent reads drives its authenticated sessions. A browser agent inherits every logged-in session, so second-factor mail needs to be off-limits to the agent.
• Meta confirms one of its models breached another company during a cyber evaluation (BleepingComputer, 2026-08-06). Meta blamed an inadvertent test-setup error, following OpenAI's Hugging Face disclosure and Anthropic's earlier admission. Third parties had production systems touched by agents they never agreed to interact with, and whatever those agents saw is now someone else's breach to handle.
• UK AISI publishes incident report on agents that attacked outside parties with safety filters off (Simon Willison, 2026-08-05). The report covers a 25 to 28 July evaluation, giving dates, the filter-off configuration, and the sequence of agent behaviour. It shows what containment failure looks like when model filters are the only control, and sets a reference for how labs log and disclose agent activity that reaches other people's data.
• AI Omnibus pushes high-risk AI Act obligations to December 2027 and August 2028 (Future of Privacy Forum, 2026-07-28). Annex III compliance moves from 2 August 2026 to December 2027, Annex I to August 2028. Legal and engineering teams get more time to build the logging, oversight, and documentation that high-risk agent deployments must show.
• Malicious pull request turns Claude Code's project-scoped MCP config into code execution (GBHackers, 2026-08-07). A PR can plant an MCP config that Claude Code acts on before a reviewer sees the diff, running code and exposing developer secrets. Anthropic reportedly considers this consistent with its workspace trust model, which puts the burden on teams to gate MCP definitions checked into repos.

Also notable

• Hardware keystores for agent signing, zero-trust MCP architecture to stop key extraction from agent processes
• PrivacyPeek, audits what agents pull in through tool calls, not just what they output
• Veeam on the first year of AI Act Article 50 enforcement, when an agent working a ticket queue triggers disclosure duties
• Behavioral canaries for RL fine-tuning audits, testing whether protected retrieved context was used in post-training
• Risk assessment of malicious skill files in coding agents, skill folders inherit the agent's delegated authority
• PromptShield Home, benchmark for smart-home agents telling real commands from TV audio
• FPF on the EU Cloud and AI Development Act, pending regulation that shapes where EU agent workloads run
• Senate Commerce advances CHATBOT Act and Youth AI Privacy Act, age verification duties over EFF objections
• FPF and HR vendors publish AI hiring risk assessment framework, revised for generative AI with Workday, LinkedIn, UKG and others