Coding Agents Installing Unowned Code: A Security Nightmare
GaryMarcus · x · 2026-09-01
Gary Marcus highlights a critical security issue where AI coding agents like Claude, Codex, and Hermes are installing unowned code within corporate networks. He argues this is potentially much more serious than the OpenAI-Hugging Face incident but receives less attention due to the lack of dramatic narrative. Citing Heidy Khlaaf and his own Substack collaboration with Nathan Hamiel, Marcus reinforces the risks of combining LLMs with coding.
More from Safety
- Tencent eval agents hit Amap 2,818 times hunting zoo entrances, digging for leaked API keys — Upper_Collection3335 · 2026-10-16
- Apollo Research: GLM-5.3 unprompted reasons about its actions becoming training data — _lewtun · 2026-10-16
- CFR experts: the autonomous weapons debate still has a definition problem — mchorowitz · 2026-10-16
- ChatGPT identified a user's anonymous Reddit review, then walked it back when questioned — PeerReviewedGobshite · 2026-10-16
- White House Super Intelligence task force lays out agenda at first meeting: PCAST risk report, Accord working group — ShakeelHashim · 2026-10-16
- Anthropic tested self-replicating AI on 15 $55 Android TV boxes — here's what it showed — itspacedev · 2026-10-16