Three AI Coding Tools Still Vulnerable to Windows Privilege Escalation via ProgramData Folder

·1 views

Cymulate Research Lab disclosed on August 11, 2026, that four AI coding tools — Claude Code, Cursor, Codex CLI, and Gemini CLI — load machine-wide configuration from C:\ProgramData\, a Windows directory writable by any standard user. An attacker with a normal account can plant a malicious hooks or config file in that directory, causing arbitrary commands to execute under any user who launches the tool, including administrators. Anthropic patched Claude Code and received CVE-2026-35603, but Cursor, Codex CLI, and Gemini CLI remained unpatched at the time of publication. The root cause is that these tools, typically installed via npm or CLI commands without elevated privileges, never restrict the permissions of their ProgramData subdirectories. Codex CLI carries additional risk, as a planted config file can also disable its sandbox and auto-approval safeguards entirely.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Launches Gemini 3.7 Flash With Improved Agent Planning and Global API Access

Google has released Gemini 3.7 Flash, the successor to Gemini 3.6 Flash, positioning it as its most capable workhorse model for coding and agent-based tasks. The model brings improvements in instruction following, intent understanding, and multi-step planning, aiming to reduce manual retries in real-world AI workflows. Google is rolling it out globally across consumer, enterprise, and developer channels simultaneously. Introductory API pricing is set at $0.75 per million input tokens and $3.75 per million output tokens, valid through December 31, 2026, after which rates double. The model also reports benchmark gains over its predecessor in areas including FrontierCode, DeepSWE, and web development tasks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why One SaaS Company Ditched Per-User Pricing for a Value-Based Model

A B2B SaaS company discovered that an enterprise client with 300-plus employees was sharing login credentials among staff to avoid paying for additional seats, exposing a fundamental flaw in per-user subscription pricing. The company found that charging per seat actively discouraged product adoption and penalized customers for expanding tool usage across their organizations. With the rise of AI automation, the problem deepened further, as software delivering greater efficiency with fewer human users would paradoxically generate less revenue under a headcount-based model. After auditing 14 months of churn and downgrade data, the company identified recurring failure patterns in its seat-based pricing structure. It subsequently abandoned user-based billing in favor of a value-led pricing strategy, which it credits with significantly improving its Net Revenue Retention.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Actions Checkout v7 blocks fork code by default, moves credentials to ephemeral storage

GitHub has released Checkout v7, a security-focused update to its most widely used GitHub Action, which powers millions of CI/CD workflows daily. The update blocks automatic checkout of fork pull request code when workflows run with elevated privileges, requiring developers to explicitly set a flag called 'allow-unsafe-pr-checkout: true' to override this behavior. Credentials, previously stored in .git/config where any containerized process could read them, are now written to an ephemeral file under the $RUNNER_TEMP directory that is deleted after each job and not accessible to container actions by default. The changes address a structural vulnerability where fork contributors could submit pull requests that execute malicious code with full access to repository secrets and tokens. The rewrite also migrated the codebase from CommonJS to ECMAScript Modules, patching known vulnerabilities in older dependencies, though Docker container actions now require Actions Runner v2.329.0 or later to function correctly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic Launches MHS Research Preview to Let AI Agents Control Lab Hardware

Anthropic has released a research preview of the Model Hardware Standard (MHS), an open standard designed to give AI agents a unified way to discover and operate physical devices such as microscopes, liquid handlers, and robotic arms. Rather than requiring custom integrations for each instrument, MHS provides a shared driver and interface layer through which Claude-enabled agents can coordinate multi-device workflows. The standard supports three access methods — Model Context Protocol (MCP), command-line interfaces, and APIs — to accommodate different development environments. Anthropic acknowledges the preview is an early-stage release with current coverage strongest in lab and manufacturing equipment, with plans to expand device support over time. The company has indicated that open-source timing and broader scope details will follow, positioning MHS as an evolving integration framework rather than a finalized specification.

0 comments Read more at DEV Community