Agent sparse worktree blindness in monorepo workflows
Learn how AI coding agents miss out-of-cone callers in Git sparse worktrees and how to enforce full-repository search using git grep HEAD.
Oct 19, 20265 min read0 reactions0 comments
Back to articles Oct 19, 2026 
Sep 4, 2026
Tag archive
#developertooling
P
Oct 18, 2026Plugin4Shell: The Zero-Click RCE That Arrived Through AI Coding Agent Plugins
A shared plugin installation path across four coding agents let package metadata influence execution without any further interaction.
Oct 18, 20263 min read0 reactions0 comments
A
Oct 15, 2026A Review Belongs to a Commit
A reviewer sees a change and raises a useful concern. The author pushes another commit. The...
Oct 15, 20266 min read0 reactions0 comments
Y
Oct 11, 2026Your telemetry toggle was a file access control
Updated 11 October 2026: Claude Code 2.1.281 fixed this the day this piece ran; AGENTS.md now loads...
Oct 11, 20263 min read0 reactions0 comments
T
Oct 9, 2026The Work Around the Agent Is Engineering Work
A coding agent returns a plausible diff. The local tests pass. It has followed the requested format...
Oct 9, 20267 min read0 reactions0 comments
Rust LSP Low Memory: How to Run Glancer Locally on 8GB RAM
Rust LSP low memory is achievable: Rust Glancer runs on 8GB machines by freezing analysis at save and offloading to disk.
Sep 4, 20268 min read0 reactions0 comments
T
Sep 20, 2026The Shai-Hulud npm worm showed that opening a folder is enough to run code
How the Shai-Hulud npm worm executed code through editor and agent configuration files, and why build provenance did not stop it.
Sep 20, 20263 min read0 reactions1 comments
D
Aug 24, 2026Devin Desktop v3.8.20 shares terminal output and local edits with third-party ACP agents by default
Devin Desktop v3.8.20 shares terminal output and local edits with third-party ACP agents by...
Aug 24, 20269 min read0 reactions0 comments
V
Aug 24, 2026Vercel comments CLI, 20 August 2026: a 2018 doc stamp and an empty permissions block
Vercel comments CLI, 20 August 2026: a 2018 doc stamp and an empty permissions...
Aug 24, 20269 min read0 reactions0 comments
Y
Sep 17, 2026Your Coding Agent Reads the Repository Before You Do: Configuration Injection in AI Developer Tooling
Configuration injection flaws in AI coding agents let a crafted repository execute commands with the developer's privileges. The fix is treating repository config as untrusted input.
Sep 17, 20263 min read0 reactions2 comments
F
Sep 17, 2026Finding the Agent Infrastructure: What Internet Measurement Can and Cannot Say About AI Coding Tool Exposure
Internet measurement cannot see a local AI coding agent, but it can map the credential-bearing infrastructure that determines the blast radius of a compromise.
Sep 17, 20264 min read0 reactions1 comments
C
Aug 21, 2026Cursor put subagents on their own VMs on 19 August 2026 - the bill is still token-shaped
Cursor put subagents on their own VMs on 19 August 2026 - the bill is still...
Aug 21, 202610 min read0 reactions0 comments