coding assistants news
2 stories
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Recent reports indicate that researchers have uncovered critical vulnerabilities within Anthropic's Claude Code and Google's Gemini CLI tools. These flaws reportedly enabled unprivileged attackers to achieve code execution on Continuous Integration (CI) runners. The vulnerabilities have since been patched by the respective vendors and assigned CVE identifiers, though the specific CVEs were not…
HalluSquatting Attack Exploits AI Coding Assistants to Deliver Malware
A novel attack vector, dubbed "HalluSquatting," has been identified that exploits the inherent "hallucination" tendency of AI coding assistants to recommend non-existent project names. Threat actors can register these fabricated project names, effectively squatting on them, and then manipulate the AI into suggesting these malicious versions to developers. This technique ultimately leads…