Daily digest · 2026-09-03

Daily Digest, 2026-09-03

TL;DR: Coding agents are the weak point today. A repository's own Git settings can make Claude, Codex and Cursor run an attacker's commands on a developer's machine with no prompt, and a new Shai-Hulud worm variant now hunts credentials in 469 places, including the config files your AI assistants keep keys in. On the surveillance side, 404 Media found Texas police used an AI writer to draft the report about their own plate-reader searches for a woman who had an abortion, while Texas and Florida pulled back on plate reader networks. Research adds a quieter worry: agents can leak facts about people in their hidden context without any jailbreak, and a lawsuit may force the government to publish the secret criteria it uses to test frontier models.

Top stories

• A repo's own .git config can make Claude, Codex and Cursor run attacker commands (The Hacker News, 2026-09-02). Manifold Security disclosed eight flaws across seven command-line coding agents where cloning a repo gets code execution as the user, outside the sandbox and with no approval prompt; four were unpatched at publication, and the attacker inherits whatever files and credentials that developer can read.
• Shai-Hulud worm variant now hunts credentials in 469 locations, AI tool configs included (The Hacker News, 2026-09-03). GitGuardian found an infostealer scanning 469 paths, up from 189, now covering assistant and agent config files. Keys taken from those files open the model and data services the agent talks to, which is where user content sits.
• Texas police used AI to write the report about running Flock searches on a woman who had an abortion (404 Media, 2026-09-02). A department paired automated plate-reader querying with an AI writing tool to produce the record of that querying, in a case touching reproductive health. The paper trail oversight depends on was itself written by a model.
• Texas and Florida pull back on automated license plate readers (EFF Deeplinks, 2026-09-02). Two state-level actions in late August curb ALPR networks, starting with a move by the Texas governor on August 28. These set what recognition pipelines may retain about people's movements and who may query them.
• Lawsuit may force disclosure of the secret rules behind federal AI safety testing (Ars Technica, 2026-09-02). A suit argues the administration's undisclosed frontier-model review criteria may hide corruption, and a court could order them published. Until then, providers cannot show customers how their systems were assessed.
• Context inference attacks pull sensitive context out of agents without any jailbreak (arXiv cs.CR, 2026-09-03). Agents assemble health records and financial documents into a hidden context, and this work recovers facts from it while every direct disclosure attempt is refused. Refusal-based guardrails and jailbreak testing miss the path entirely.

Also notable

• ACLE-MCP binds a remote MCP tool call to the attested workload that runs it, closes an OAuth gap where an authorized endpoint can hand execution to a substituted workload.
• SANS and AWS: scope the retrieval query to the user's permissions, argues access enforcement belongs under RBAC at the data layer, not in the system prompt.
• Verbatim field egress measured across an MCP leg and an A2A leg, tests whether fields marked not-shareable leave word for word after a second protocol hop.
• An agent's own memory can grant it authority the history never gave it, authorization failure from memory state, so revocations may not stick.
• Agent tool orchestration leaks a sensitive conclusion no single tool return contained, with a dataset, benchmark and mitigation for cross-tool inference.
• Black-box membership inference against TTS models fine-tuned on private voices, tells an attacker whose recordings went into a voice clone.
• Reed Smith partner on the insurance gaps AI companies are walking into, governance answers on insurance applications become warranties an insurer can use to deny a claim.
• EvalDetectBench measures whether frontier models know they are being evaluated, open benchmark bearing on whether evaluation evidence describes the deployed system.

Beyond AI

• EFF grades the new state location-privacy laws against its own rubric (EFF Deeplinks, 2026-08-31). EFF reviews what state legislatures passed since its location-privacy rubric last year and names where the statutes fall short of enforceable limits on commercial tracking. These laws set the consent and purpose limits any model or agent consuming commercial location feeds will have to meet.