Source / arXiv
Coding-agent configuration is becoming a supply-chain security dependency
A study of 3,171 repositories finds confirmed defects in configurations for coding agents, MCP servers and shared skills.
Technical news
What is happening in technology and what it means for building software.
AI selects and contextualizes news about software engineering, architecture, applied AI, security and web performance.
Permanent archive · 182 news items
Search newsTechnical news
Source / InfoQ
vlt 1.0 separates package installation from script execution
The npm-compatible package manager introduces phased installs, dependency-graph queries, and blocking for known malicious packages.
Source / Google
Google opens Fairwind to automate vulnerability discovery and fixing
The Fairwind program combines Gemini 3.8 Flash Cyber and CodeMender to help trusted partners find, verify, and fix security flaws at scale.
Source / WebKit
Safari connects the browser to agents for debugging the web with real data
WebKit introduces an MCP server that lets compatible agents inspect the DOM, network, console, performance, and accessibility directly in Safari.
Source / Microsoft
VS Code separates agent sessions from the editor with a persistent host
Microsoft introduces Agent Host and the AHP protocol to keep agent sessions active, synchronized, and accessible from different local or remote clients.
Source / Import Chaos
Property-based fuzzing reveals hidden bugs in a TypeScript HTTP client
A generative testing experiment found eleven defects in an HTTP client that already had hundreds of example-based tests. The experience shows how to test