The biggest security event in agent infrastructure to date. CVSS 10.0 — a Trivy plugin injects malicious tool definitions through VS Code extensions, targeting 5 coding agents (Claude Code, Cursor, Copilot, Codex, Windsurf). The attack chain: compromised security scanner → extension marketplace → agent tool registry → arbitrary code execution with full filesystem access.
This isn't theoretical anymore. APIMitmHack (46⭐) was also discovered targeting OpenClaw by name. Meanwhile, HN lit up about PyTorch Lightning supply chain malware (426pts) — the "Shai-Hulud" package injected into AI training pipelines.
Three independent supply chain attacks in one week, all targeting AI/agent infrastructure.
bypassPermissions in Claude Code deserves extra scrutiny — any prompt injection gets full FS access.
A 12⭐ TypeScript project packing four major patterns into one: worktree isolation, DAG scheduling, ensemble voting, and local graph memory — all for orchestrating Kimi Code CLI.
The standout idea: ensemble voting per-role. For a single coding task, spin up 2-3 candidates with different perspectives (e.g., correctness vs. performance vs. maintainability), then aggregate with quorum ratio. Like self-consistency prompting, but at the task level.
The local graph memory auto-extracts typed concepts from markdown using keyword heuristics — fragile but conceptually interesting. GraphQL-lite query API for traversal.
Hermes (127k⭐) shipped two major features validating directions we've been tracking:
Autonomous Curator: A background agent (forked AIAgent) automatically scores, merges, and archives skills on a 7-day cycle. Usage-based evaluation, archive-only (never deletes). This is self-evolution-as-skill made real — and they dedicated an entire release to it.
Tool-Call Loop Guardrails: Three-axis detection covering exact parameter repeat + same-tool repeat + idempotent no-progress. Warning-first, graduated response, opt-in hard-stop. The first system to simultaneously cover all three failure modes — more complete than OpenClaw's detection or nanobot's hard caps.
codejunkie99/brain (32⭐, Rust) takes the "git as memory" idea further than anyone: every memory event is a git commit, SQLite FTS5 is a derived read index. Key innovations:
• Bitemporal queries — separate time_observed (when it happened) from time_recorded (when agent learned it). Critical for belief revision
• Supersession chains — Claim A → Claim B automatically replaces it; materialized views show only chain tips
• Git as source of truth + SQLite as index — structurally isomorphic to our wiki+memex stack
Multiple projects independently reinventing git-backed memory (brain, Fullerenes, caura-memclaw) validates our wiki-in-git approach.
Three distinct skill distribution patterns are now coexisting:
• User-authored (most common) — hand-write SKILL.md, commit to repo
• Community registry (ClawHub, npx skills) — discover + install from marketplace
• Library-embedded (tiangolo/library-skills, 185⭐) — libraries ship their own agent skills, activated via symlink. Version coherence is the killer feature: skill always matches library version
Meanwhile, reversa (365⭐, +87% in 1 day) showed SKILL.md used as multi-agent pipeline — 6 specialized agents orchestrated purely through prompt files and shared file state, zero runtime code.
Applied today: Ported Dirac's "toolcall error example" pattern to FlowForge — error messages now include valid options and example commands. Small change, big UX win.