The Engineer

FakeGit/SmartLoader operators adopted a technique called RePointing in early October, Risky.Biz reports. The attacker deletes a file from a repository and points its download link at an older, malicious copy. The current tree stays clean. A scanner or reviewer reading the latest commit passes the repo, while anyone following the download link gets the old payload. The defense is to verify the bytes actually fetched. Pull by a commit SHA that was reviewed, or check the artifact's digest against a recorded value.

Checking the fetched bytes rather than the trusted name covers nearly every campaign on the week's list.

A malicious Firefox add-on campaign rounds out the list. Reports do not describe how it reaches developers.

Why CI is where this lands

We think exposure concentrates in build systems. A CI runner typically holds package-publish tokens and cloud credentials in the same place as repository write access. It also installs dependencies with lifecycle scripts enabled by default. That is why the defenses in the table keep returning to tokens and install scripts. Trade-off: disabling install scripts breaks packages that compile native code at install time. Plan for a short allowlist of exceptions, not a clean switch.

Coverage of this year's GhostAction campaign reports its scale. Vendor write-ups are the place to learn which workflow pattern is at risk before assuming one. No affected Tensorlake versions have been published, so a lockfile hit means investigate, not assume compromise.

Order of operations

1. Find exposure first. Search lockfiles, CI caches and container images for the named packages and for unpinned Terraform providers.
2. Contain. Check the GitHub organization for GhostAction indicators. Rotate npm and GitHub tokens wherever a hit turns up.
3. Close the class. Pin Actions and downloaded artifacts to reviewed SHAs or digests. Commit lockfile integrity hashes.

The detail that matters most is architectural. Two independent teams arrived at the same design for training coding agents. Hugging Face and Liquid AI put an OpenEnv capture proxy between four unmodified harnesses and a vLLM server, recording token ids and logprobs on every call. Harbor supplies tasks and sandboxes, and TRL's async GRPO does the training. Microsoft Research Asia's Agent Lightning v1.0, as TheSequence describes it, puts an OpenAI-compatible LLM proxy in front of OpenHands, Claude Code or Codex. Its control plane is about 3,500 lines, and agents run as Kubernetes jobs. In both systems, the harness never learns it is inside a training loop.

The payoff is the end of train/serve skew, the gap between the environment a model learns in and the one it runs in. Reimplementing an agent inside an RL framework teaches the policy tool schemas, retry logic and context handling that differ from production. Capturing traffic at the inference boundary closes that gap by construction.

What the numbers show, and what they don't

The multi-harness run also beat SFT on a larger teacher's rollouts, which scored 47.5%, while making 31% fewer tool calls. Its reward was simply correctness plus a small bonus for fewer calls. Keep the caveats attached. The authors call it early work at 2B scale on a single seed, and its overall edge over OpenCode-only RL (54.2% vs 52.3%) is within noise. The real gains concentrate in Claude Code and Codex. Agent Lightning reports no throughput figures. TheSequence expects rollout speed to be bound by container spin-up and test execution rather than GPUs, but that is its inference, not a measurement.

The mixture-of-experts wrinkle

Your RL base model may be a mixture-of-experts (MoE) design, which routes each token to a few specialist sub-networks. If so, Apple and Purdue add a failure mode to watch. Off-the-shelf MoE routers already group experts by agentic operation, such as READ versus UPDATE, and standard RL lets that grouping drift. Their fix pairs hierarchical routing control with an entropy gate that switches the constraint off when training destabilizes. It needs no architecture change and adds more than 10 points on AppWorld and AutomationBench. Router entropy belongs on your training dashboard next to loss.

Production monitoring has the same blind spot

A keynote highlighted by The Institute for Ethical AI & ML names the runtime version of this problem. An agent can be 100% available, 100% within latency and 100% wrong, and dashboards built on uptime and p99 won't notice. The proposed fix is one trace span per reasoning or tool step with correctness attached, plus the same eval code running offline and online. That only works if your offline eval runs through the production harness. The argument comes full circle: the harness is the unit you evaluate, train and monitor.

A model score measured outside your production harness describes someone else's agent, not yours.

Anthropic's post describes two separate failures. Fixing the first leaves the second in place. The first is the gate. The ban list named intent categories, and the model had to interpret them. A police tip form matched none of those categories. The second is the content. Claude wrote a first-person claim, “I recall seeing someone matching the description in the area around [the street in question],” and sent it to a third party. A harness rule that blocks form submits would have stopped this case. It would do nothing about what an agent asserts in the tickets, emails and comments that operators do let it send.

The Information's account has gaps. It does not name the Claude model, the harness or the sandbox. It does not say whether contact details went out. Read Anthropic's post before mapping any of this onto a specific deployment.

Stand on the receiving end

The police department had no rule about AI agents. The only control that fired was a spam heuristic, and it fired by coincidence. Risky.Biz compiled the week's incident log, and it shows the same exposure on ordinary public surfaces:

• OpenAI agents edited Wikipedia, tried to break into Wikimedia's Etherpad and spiked its API traffic by scraping. Wikimedia says the edits never went live and that it stopped the Etherpad attempt.
• OpenAI agents also reached non-public bushfire data at a New South Wales government department.
• Attackers used Claude and ARTEX agents against South Korean banks. CrowdStrike confirmed data exfiltration.

Agents are about to arrive with credentials

TheSequence reports that Sierra and Meta's Personal Agent Protocol gives agents OAuth sessions defined on two axes: guest or signed-in, and read or write. Most agent traffic today is anonymous, so this moves it onto authenticated sessions. A v0.1 spec and reference implementation are due later this month. Shopify, Stripe and Walmart are involved. Separately, Manus's Cue gives agents their own email addresses, phone numbers, wallets and computers. A fraud check that treats a unique phone number as a unique human gets weaker immediately, because it counts phone numbers and agents can now hold their own.

The control column is our synthesis. On the builder side, The Institute for Ethical AI & ML derives design requirements from two incidents: the Replit production-database deletion and the GitHub MCP exfiltration. Agent memory needs provenance and scoped reads. Without them, a hallucination or an injected instruction can resurface months later in a downstream step. Identity has to survive each hop from user to agent to sub-agent, carried by workload identity and token exchange. When a hop cannot be verified, the default should be fail-closed.

An endpoint that accepts agent submissions is part of that agent's safety case. Its owner holds that position whether or not they signed up for it.