AI auto-exploitation hits 91.3% on real codebases — vibe coding's security wake-up call
lxfater · x · 2026-11-07
The author warns that while devs ship sites at AI speed with Claude Code and Codex, AI-driven reverse engineering and vulnerability discovery are moving even faster.
- In the CyberGym Level 1 benchmark on real software codebases, the GCSA Agent reached a 91.3% success rate
- AI tooling itself is a target: an MCP package previously referenced by a platform was re-registered by a third party, enabling potential supply-chain poisoning and API key theft
- The quoted thread also highlights Vercel's open-source agent-desktop: it lets Claude Code/Codex/Cursor control a full desktop without stealing your mouse — instead of screenshot-and-guess, it reads the OS accessibility API for widget identifiers, supports multiple AIs with separate virtual cursors, and works on Mac/Windows/Linux
Caveat: the latter half reads as promotional for a security vendor; verify claims independently.
More from coding & agent
- Indie dev builds Calorie Cub, an agent-first calorie logger, after MyFitnessPal's MCP broke — Odd_Apricot_3402 · 2026-11-07
- Agent security swarms: shared-wallet bug bounty hunting with zk proofs-of-exploit — banteg · 2026-11-07
- The Agentic Web: a personal AI assistant that operates every website you visit — JnBrymn · 2026-11-07
- Agents have wallets: BoundlessHQ adds pay-per-token stablecoin streaming payments — banteg · 2026-11-07
- Testing shows coding harnesses can be harmful or hugely helpful depending on the model — JoshPurtell · 2026-11-07
- Tip: Run /prototype on Small UI Changes to Get Several Options to Pick From — mattpocockuk · 2026-11-07