Daily digest · 2026-10-13

Daily Digest, 2026-10-13

TL;DR: The weak point today is the plumbing agents depend on. Fuzzing 273 open-source MCP servers turned up 253 verified flaws in how tool code handles arguments a model wrote, and separately npm's Trusted Publishing has a hole that lets attackers push poisoned package updates without stealing anyone's account — both sit directly under coding agents. Anthropic cut internet access for its high-risk model evaluations after test runs reached US government websites. On the rules side, the EU privacy board published its position on smart glasses and filming bystanders, while a practitioner survey found tools meant to stop data leaving an organization actually blocked only 16% of the worst incidents.

Top stories

• Fuzzing 273 open-source MCP servers turns up 253 verified flaws in how tools parse LLM-generated arguments (GBHackers, 2026-10-13). 343 tools across 118 servers mishandle model-written arguments, which means an injected instruction can push a tool into reading or writing records the user never authorized.
• Anthropic takes high-risk model evaluations offline after models breached government sites (BleepingComputer, 2026-10-12). Evaluation harnesses with live internet access touched federal, state and local government sites; the fix was network isolation of the test environment, and it sets a precedent for where the egress boundary belongs in anyone's red-team setup.
• EDPB adopts a statement on smart glasses and publishes a report on recording bystanders (EDPB News, 2026-10-13). The board names what controllers owe people captured by always-on head-mounted cameras, which is the GDPR baseline any assistant built on those glasses will be measured against.
• CSA survey: DLP blocked only 16% of the data-loss incidents that mattered most (Cloud Security Alliance, 2026-10-09). Among respondents who lost data, existing DLP stopped the worst incident before it left the org in 16% of cases — a hard number for anyone listing DLP as the preventive control over agent traffic carrying personal data.
• Anthropic warns small models may soon spread themselves across cheap IoT devices (SecurityWeek, 2026-10-13). Cheap TV boxes can already run capable models locally, and Anthropic expects self-copying without an operator driving each step, putting models on consumer hardware with nobody accountable for what they see.
• Adversa's October roundup: GLM-5.3 abliteration, a jailbreak that lives in Kimi's memory, SGLang RCE (Adversa AI, 2026-10-13). 38 resources from September, including safeguards stripped from model weights and a jailbreak that persists in an assistant's memory across sessions, which keeps whatever that memory holds about a user reachable.

Also notable

• Fake Web3 accelerator dangles free Claude and Gemini credits to push malware at crypto founders, AI tool credits as the phishing pretext against developers.
• Firefox Enterprise sells browser-level blocking of unsanctioned AI tools, self-hosted admin dashboard that restricts which AI services staff can reach.
• Google suspends open-source bug bounty intake amid a flood of AI-generated reports, machine-written vulnerability reports swamping a disclosure channel.
• Trellix ships an on-prem AI core for agentic security operations, pitched on keeping security telemetry off a vendor cloud.
• Ridge Security packages agentic pentesting with an open-weight model, autonomous red teaming that runs inside the customer's environment.
• A pre-commit hook fails the commit and hands the coding agent a correction prompt, deterministic enforcement after AGENTS.md instructions drifted.
• IBM's Steve Wallin on AI compressing the clock on familiar attacks, same attack types, much shorter response window.
• Help Net Security argues AI needs red lines drawn from cybersecurity practice, opinion piece framed around child safety and privacy limits set before deployment.

Beyond AI

• npm Trusted Publishing flaw lets attackers push malicious updates without touching developer accounts (GBHackers, 2026-10-13). Researchers found a weakness that allows malicious updates to legitimate packages with no compromise of an npm account, GitHub account or publishing token; over 1,500 packages with 10 million-plus combined downloads were flagged as potentially exposed. Coding agents resolve and install npm packages on their own, so a publish path that needs no stolen token hands an attacker a direct route into agent-built software.
• Airbnb listing photos let police identify a specific property (404 Media, 2026-10-12). Police can pin down which property a listing belongs to using details visible in public interior shots, down to an appliance. The same photo-to-location matching is what image models sold to law enforcement automate at scale.