AI Coding Tools Face Security Crisis: Grok, Claude, Copilot All Under Fire

·1 views

In July 2026, multiple AI coding assistants faced serious security failures that eroded developer trust industry-wide. Security researcher cereblab discovered that xAI's Grok Build was silently uploading entire codebases, including plaintext API keys, to a Google Cloud bucket, even when users disabled the 'Improve the model' toggle. Anthropic's Claude Code was flagged by China's MIIT for an alleged covert surveillance backdoor, prompting Alibaba to ban it company-wide on July 10, while GitHub Copilot was caught injecting unauthorized ads into thousands of pull requests. Separately, Anthropic leaked its own proprietary source code three times in 13 months by accidentally shipping public npm packages containing internal source maps. As of July 14, xAI had issued no public statement or commitment to a permanent fix, despite quietly disabling the upload server-side the day after the report surfaced.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Kivex Launches as Open-Source Icon Library Supporting Eight Dev Frameworks

A developer has publicly introduced Kivex, an open-source icon ecosystem designed to provide consistent SVG icons across multiple frameworks and platforms. The library offers over 200 lightweight, pixel-perfect icons under the MIT license, with TypeScript support included. Kivex currently ships dedicated packages for React, Vue, Svelte, Solid, React Native, Flutter, and a core JavaScript module, all sharing the same icon names and visual design. The project aims to eliminate the need for developers to adopt separate icon libraries when switching frameworks, maintaining a unified design language throughout. Future plans include expanding the icon set, adding official documentation, an icon search tool, and encouraging community contributions via its GitHub repository.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Focused Script-Timing Tool, Learns One Feature Beats Feature Bloat

A developer built ScriptTimer, a web app that estimates how long a script takes to speak aloud, after repeatedly misjudging recording lengths based on word count alone. Despite an initial urge to add user accounts, AI suggestions, and analytics, the creator stripped the product down to four core elements: a text area, word counter, speaking speed selector, and duration estimate. Launching a minimal viable product early allowed real user feedback to guide improvements instead of assumptions made during development. The developer also structured the site into separate pages for distinct use cases — such as a Podcast Timer and YouTube Shorts Timer — improving both usability and search discoverability. The experience reinforced the lesson that solving one problem well and shipping fast outweighs building an expansive feature set nobody has yet requested.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Adds Native GBNF Grammar Support to Local LLM Structured-Output Library

A developer building a local, low-latency text classification pipeline found that existing schema types in the shapecraft library could not directly apply GBNF grammars to constrain llama.cpp model output. GBNF (Grammar-Based Normalization Format) forces a language model to produce only tokens valid under a defined grammar, making malformed outputs structurally impossible rather than merely unlikely. To fill the gap, the developer added a new schema-input type accepting a raw GBNF string, returning a plain string result rather than a parsed object. When paired with a llama.cpp backend, the grammar is enforced at the token level with a "constrained" guarantee; for cloud APIs like OpenAI or Anthropic that lack a grammar parameter, the grammar is injected into the prompt and outputs are validated post-generation with a "best-effort" guarantee. The implementation also includes a bundled GBNF interpreter that handles recursive rules and avoids catastrophic backtracking by deduplicating parser states by position rather than path.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AMID Framework Uses Multi-Agent AI to Automate Medical Imaging Model Development

Researchers have introduced AMID, an Autonomous Multi-Agent framework designed to automate the development of medical imaging machine learning models. The framework addresses longstanding challenges in the field, including modality-specific experimentation, strict validation protocols, and regulatory compliance requirements. AMID is built on two core innovations: Data-Conditioned Method Planning, which tailors development pathways to specific datasets and available resources, and Verification-Guided Two-Stage Optimization, which balances broad solution exploration with rigorous auditing standards. Unlike general-purpose machine learning automation tools, AMID is purpose-built for medical imaging workflows, aiming to replace manual, bespoke engineering processes with an efficient agentic pipeline. The framework represents a significant step toward making AI-assisted medical model development both scalable and auditable.

0 comments Read more at DEV Community