The Wire / 2026-07-22
A prompt injection that exfiltrates through the terminal rather than the agent, a report that Grok's CLI uploaded local files, an Antigravity post that announced a fix on top of a headless mode that enforced nothing, and two writers arguing independently that reading old code just got cheap.
-
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
Rehberger's write-up describes an attack that never asks the agent to run anything: ANSI escape sequences in model output make macOS Terminal do a DNS lookup, and the data leaves with it. If your threat model stops at the agent's tool calls, the terminal that renders its output is outside the model. The mechanism is his demonstration; we have not reproduced it.
-
The Pulse: Grok's CLI caught uploading all your local files to the cloud
Pragmatic Engineer reports that Grok's CLI sent local files to the cloud wholesale. If that holds, it is the largest version yet of a coding CLI reaching past the directory it was given. It is their reporting, not a finding of ours; a vendor statement or a reproduction would settle it.
-
Antigravity CLI 1.1.3 is out
The post says headless mode "no longer hangs or silently auto-approves tools that need permission." Two days later the 1.1.4 changelog recorded that headless runs had only then begun honouring settings.json at all: not permissions, not file access, not sandbox mode. The announced fix sat on a mode that enforced nothing, and 1.1.4 got no post.
-
The Archaeologist's Copilot
Agents as a tool for understanding inherited code rather than producing new code. For anyone sitting on a system nobody still employed can explain, that is the cheaper first job to hand an agent. Willison makes the matching case four days later, below.
-
Reverse-engineering is cheap now
Willison argues that reading what somebody else built is now the cheap part, and he backs it with worked examples of his own rather than a benchmark. Hold vendor claims about what agents can do this month up against it. The examples are his, chosen by him.
-
Claude Code uses Bun written in Rust now
Willison reports that Claude Code now runs on a Rust rewrite of Bun. A runtime swap under the CLI you run every day is the kind of change operators tend to meet as a startup regression before they meet it in a release note. If a launch misbehaves this month, check the runtime first.
-
A Fireside Chat with Cat and Thariq from the Claude Code team
An annotated transcript, a better format than a clip. Its biggest claim, that Claude Code's system prompt shrank by roughly 80 percent for newer models, is the vendor's own account, and the changelog through v2.1.216 records no such reduction. The direction is plausible; the magnitude is theirs.
-
Pushing software engineering limits with napkin math
Estimation as the skill that survives. When an agent writes the code and you review it, the first question is whether the numbers in front of you are the right order of magnitude. That makes napkin math a review skill, not an interview exercise.
-
Everyone Should Know SIMD
Hashimoto makes the case for understanding the machine at the level of vector instructions. Read it as the counterweight to delegating all the typing: knowing where the cycles go is what lets you tell whether the agent's fast code is actually fast.
-
Claude Code 2.1.216: sandbox.filesystem.disabled
Forty CLI changes, and the one to read is a new setting that turns off filesystem isolation while keeping network egress control. That is a legitimate configuration for some workloads and a foot-gun for others. Know which one you run before you set it.