Friendly Fire turns the security agent into the exploit
In 2026, AI Now showed RCE in Claude Code and Codex during third-party repo review; isolate permissions, sandbox, network and CI evidence before risky PRs.
|
I'm Samuel Fajreldines I am a specialist in the entire JavaScript and TypeScript ecosystem (including Node.js, React, Angular and Vue.js) I am expert in AI and in creating AI integrated solutions I am expert in DevOps and Serverless Architecture (AWS, Google Cloud and Azure) I am expert in PHP and its frameworks (such as Codeigniter and Laravel). |
|
Samuel Fajreldines I am a specialist in the entire JavaScript and TypeScript ecosystem (including Node.js, React, Angular and Vue.js) I am expert in AI and in creating AI integrated solutions I am expert in DevOps and Serverless Architecture (AWS, Google Cloud and Azure) I am expert in PHP and its frameworks (such as Codeigniter and Laravel).
|
Latest articles
In-depth guides and tutorials on JavaScript & TypeScript, Node.js, AI, DevOps and Serverless by Samuel Fajreldines.
Articles
Your agent can clone a repo that never existed
In 2026, arXiv measured up to 85% hallucination in repo cloning; lock origin, MCP and CI before the agent executes.
GhostApproval shows when the agent diff lies
In 2026, Wiz tested 6 coding assistants; learn how to review symlinks, sandboxing, and approvals before agents write outside the workspace.
Unknown repos need an agent quarantine step
In 2026, 0DIN showed a payload outside the repo; use agent quarantine with sandboxing, denied network, and no setup secrets.
MCP allowlists keep coding agents on rails
In 2026, MCP research found 57 threats; use tool allowlists, private registries, CI gates, and logs for coding agents.
