AI Coding Agent Hijacked to Spread Worm Across 100 Repos Amid Agentic Investment Surge

·9 views

Cybersecurity firm Mandiant reported that an attacker hijacked an AI coding-assistant session at a SaaS provider, using it to propagate the Shai-Hulud worm through approximately 100 internal code repositories — marking one of the first confirmed real-world cases of an agentic tool being exploited as a supply-chain attack vector. The incident coincided with major funding activity in the AI agent space, as orchestration platform Temporal closed a $550 million Series E at a $12.55 billion valuation, and coding-agent startup Factory tripled its valuation to $5 billion after raising $200 million. Security vendor Exaforce responded to growing concerns by launching a kill-switch capability within its AI Security platform, offering runtime containment controls for AI agents across endpoint and cloud environments. Analysts note that the same features making agentic tools powerful — persistent sessions, broad repository access, and autonomy — are the properties that make them attractive targets for attackers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Insufficient content to generate a headline

Insufficient content to generate a summary. The source article text contains no reportable information beyond a title and URL. No facts, events, or claims are present to paraphrase or summarize accurately.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Vendor's 200x Speed Claim Shrinks to 3–12x Under Real Workload Testing

A software team tested TypeSafe AI's model 'Jev' against their existing open model using a real production task: classifying email accounts on an admin dashboard. End-to-end, the new model proved 12x faster at the median, narrowing to roughly 3x once accounting for unnecessary output from the old model, and 7x cheaper — primarily because outbound tokens are free on the new platform. The team admits they produced two confident but incorrect benchmark figures before arriving at valid results, including repeating the very measurement error they had previously criticized the vendor for. The most meaningful finding was not speed but consistency: the new model showed just 38ms of latency variance compared to 2,353ms on the old one, eliminating parse failures that had been causing error pages. The team concludes that benchmarks are only useful when run on your own workload, close to production, with a reliable correctness check that does not rely on another model's judgment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why yfinance Fails at Scale and How to Build Reliable Options Data Pipelines

Fetching stock prices in Python is straightforward, but retrieving full options chain data — including strikes, implied volatility, open interest, and volume — reliably across hundreds of tickers is a significantly harder engineering challenge. Libraries like yfinance work well for small-scale exploration but are prone to rate-limit errors, empty responses, and silent failures when used in production environments. These tools act as convenience wrappers rather than true data pipelines, leaving developers to handle retries, schema normalization, and monitoring themselves. A structured approach involves defining a consistent per-contract data schema and building a dedicated data layer that handles throttling, scheduling, and error recovery. Separating the data infrastructure from the trading or analytics logic allows developers to focus on strategy rather than repeatedly fixing broken data feeds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Read Replicas Boost Database Speed but Can Serve Stale Data to Users

Adding a read replica to a database offloads traffic from the primary server and improves read performance, but introduces replication lag that can range from milliseconds to minutes. During this lag window, users may see outdated information — such as a profile update not reflecting immediately or an order status showing as pending after payment. This occurs because replicas apply changes only after they have committed on the primary, a behavior known as a read-after-write violation. Replication lag is not a fixed, predictable value; it varies based on write load, long-running queries, large transactions, and maintenance activity. Engineers are advised to route consistency-sensitive reads — such as balance checks, order status, and post-write fetches — directly to the primary rather than treating all reads as safe to serve from a replica.

0 comments Read more at DEV Community