8 high-signal links · security, pricing, adoption
High-signal only — no just-shipped noise.
Beware: Your Coding Agent’s "Safe Mode" Can Be Turned Into a Remote Code Execution Engine
AI Now Institute’s "Friendly Fire" exploit shows that Claude Code auto-mode and Codex auto-review — the modes marketed as the safe way to work — execute attacker payloads when pointed at untrusted code. Here’s the attack chain, who’s exposed, and what to do instead.
Context Engineering for Coding Agents: How to Make Every Token Count
Practical patterns for structuring your codebase, prompts, and project files so coding agents produce better code with fewer wasted tokens. Covers AGENTS.md optimization, prompt framing, context window tricks, and the mistakes that silently tank agent quality.
Agent Skills Went From Zero to 670,000 in Eight Months. Now Comes the Security Reckoning.
SKILL.md conquered 26+ coding agent platforms in under a year. A Snyk audit found 13.4% of community skills contain critical security flaws. Here is how we got here and what to do about it.
Your AI Agent’s Config Directory Is Now the Most Dangerous Place on Your Machine
Six major campaigns in 2026 — GhostApproval, TrapDoor, Miasma, IronWorm, Clinejection, RoguePilot — all converge on the same attack surface: the tiny config files your coding agent trusts implicitly. Here’s why .cursorrules, CLAUDE.md, and settings.json became the primary weapon class against developers.
Beware: Codex Desktop Subagents Are Leaving Ghost MCP Servers Behind — And Now It’s Breaking Windows
A growing cluster of reports shows Codex Desktop’s multi-agent workflows leak dozens of Node.js processes and gigabytes of RAM per session, trigger sustained WMI/Defender CPU storms, and run planning loops that never deliver. Here’s what we found and what to do.
How to Run Coding Agents with Ollama: The Complete Local Setup Guide
Stop paying per token. This guide covers installing Ollama, picking the right local model, and wiring it into Claude Code, OpenCode, Hermes, Kilo, and five more coding agents — with benchmarks against cloud equivalents.
The Great Coding Agent Consolidation: Why Three Deals in 30 Days Redrew the AI Dev Tools Map
Google took Windsurf’s founders for $2.4B. Cognition bought the rest for $250M. Sourcegraph spun out Amp. These aren’t isolated events — they’re the opening moves in a vertical integration race that will define which coding agent companies survive 2026.
Coding Agents Writing Coding Agents: The Self-Improvement Loop
yoyo-evolve went from 200 lines to 115K lines with every commit agent-written. Cursor runs 1,000 agent commits per second. Here’s what the self-referential coding loop means for developers.
Leaderboard
Track live adoption: AI Coding Agent Leaderboard
Embed: /embed/leaderboard/
Subscribe
Get this weekly: form on terminalblog.com