Two of today's stories are the same move seen from different sides: an attacker who stops bothering with your code and writes into your assistant's context instead — the rules file it reads on startup, the memory it keeps between sessions. Neither one shows up in a diff. The other two are quieter: a survey that says most teams are guessing about whether any of this works, and a cheap Google model that renamed a parameter you are probably still sending.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
A supply-chain campaign is writing hidden instructions into your CLAUDE.md
Socket's researchers have been tracking a campaign called TrapDoor: more than 34 malicious packages across 384-plus artifact versions, published to npm, PyPI and Crates.io since May 19, all posing as ordinary developer utilities aimed at the crypto, DeFi, Solana and AI communities. The credential theft is conventional. A package runs at npm install, at Python import, or during cargo build, then goes looking for SSH keys, GitHub tokens, AWS credentials, environment variables, browser data and wallet keystores.
The part that makes this a story for us is what the npm payload does afterward. It writes .cursorrules and CLAUDE.md files into the project — the exact files Claude Code and Cursor read to learn what a project expects of them — with attacker instructions concealed using zero-width Unicode characters. The malware does not have to exfiltrate anything itself. It asks your agent to, in text that renders as nothing on screen and as nothing in a pull request.
Two details make this harder to catch than the usual npm incident. Every package in the campaign shipped clean, with no known-vulnerable version history, so conventional vulnerability scanners return zero findings on all of it. And Socket reports a median detection time of roughly six minutes from publication — fast, and still long enough if you happened to install in that window.
For builders
Two things, and the first takes under a minute. Search your projects for invisible characters in the files your agent trusts: rg -n '[\x{200B}-\x{200D}\x{2060}\x{FEFF}]' --hidden -g '!.git' from your repo root, or the same pattern through grep -rP if you have GNU grep. Anything that hits inside a CLAUDE.md, AGENTS.md, .cursorrules or MCP config is not a formatting quirk. Second: put those files under the same review rule as source code — if a dependency install modifies one of them, that is an incident, not a diff to skim. And npm install --ignore-scripts costs you almost nothing on most projects while removing the install-time execution this campaign depends on.
Story II
Copilot could be given a memory that survives your password reset — patched August 18
Varonis Threat Labs disclosed a chain in Microsoft Copilot Personal that they call CoSnitch, and the way they found it is worth a paragraph on its own. They asked Copilot enough questions about itself, patiently, that it described its own architecture — including an undocumented ?autorun=1 URL parameter that would execute a prompt without the user doing anything. Varonis calls the technique meta-hacking. It is social engineering aimed at a reasoning engine rather than a person.
Chained with Copilot's built-in URL fetching, that parameter turns a single crafted link into an attacker prompt running inside the victim's authenticated session, reaching connected services like Gmail and Google Drive. Microsoft assigned CVE-2026-24301, rated it 8.8, and reported the fix shipped on August 18. Enterprise Copilot customers were never affected; this was Copilot Personal. Varonis reported it in December 2025 and says it found no evidence of exploitation in the wild.
The third link in the chain is the one that should change how you build. A webpage, when summarized by Copilot, could inject instructions into the assistant's permanent memory store. Varonis reports that the injection survives password changes, session revocation and device re-enrollment. Every incident-response reflex we have assumes that rotating a credential ends an attacker's access. A poisoned memory is a persistence mechanism that none of those steps touch.
For builders
If you are shipping anything with a memory feature, treat writes to it as privileged operations rather than a side effect of reading. Three rules that would have blunted this: record the source of every memory entry (which URL, which document) and show it to the user; make the whole memory readable and deletable from one screen, not buried in settings; and never let a summarization or retrieval path write to long-term memory without a distinct confirmation step. If you merely use an assistant with memory, open its memory today and actually read what is in there — most people have never looked, and it is the one place in the stack where a logout changes nothing.
Story III
96.4% of teams use AI coding tools. 20% can tell you whether it helped.
GitKraken surveyed 554 developers and engineering leaders for its 2026 State of AI in Engineering report, and the adoption number is effectively finished as a metric: 96.4% of engineering organizations use AI coding tools, with only 3.6% reporting nobody on the team touches them. Delegation is climbing fast behind it — 28% of developers now say they primarily hand tasks to agents, up from 7.6% in September 2025, and 76% run agents at some point during the workday.
Then the gap. 84% of developers say AI made them more productive, and 43% say much more productive. Fewer than 5% feel slower. But only 20% of organizations measure productivity at all, 39% have no mechanism to measure AI's impact whatsoever, and GitKraken's framing of the remainder is the line worth keeping: 72% are running on belief instead of a number.
Yesterday's digest carried LinearB's merge-rate data, drawn from millions of real pull requests, showing AI-assisted code merging at roughly a third the rate of unassisted code. Put the two together and you get the actual problem. The measured picture is more complicated than the felt one, and almost nobody has the measured picture of their own work.
For builders
Pick one number this week and write it down somewhere boring. If you work on a team, the cheapest honest metric is merged pull requests per week split by whether an agent wrote the first draft — you already have the data in your git history, you just have not labelled it. If you build solo, use two columns in a spreadsheet: tasks you handed to an agent, and tasks you shipped without rewriting the output yourself. Four weeks of that beats any survey, because it is about you. The point is not to prove AI works or does not. It is to stop being in the 72%.
Story IV
Gemini 3.7 Flash is cheap until New Year's Eve, and it will reject the parameter you are sending
Google released Gemini 3.7 Flash on August 13, positioned as the low-cost workhorse for agent loops. Introductory pricing is $0.75 per million input tokens and $3.75 per million output, with Batch and Flex processing at half that — $0.375 and $1.875. The introductory rate expires on December 31, 2026, after which it becomes $1.50 and $7.50. That is a doubling with a date on it, published in Google's own docs rather than inferred from a tracker.
There is also a breaking change hiding in the migration. The old thinking_budget parameter is gone, replaced by a string enum thinking_level that accepts low, medium (the default) and high. Sending minimal returns an error rather than degrading gracefully, which is the sort of thing you discover in production if you copied your config forward from a previous Gemini integration. The model string is gemini-3.7-flash.
For builders
Do the migration deliberately instead of by search-and-replace: swap thinking_budget for thinking_level, then decide the level per code path rather than globally. The default is medium, so if you set nothing you are paying medium prices for your latency-critical routes — drop those to low and measure the quality drop on your own eval set before assuming you need more. And add December 31 to the same expiry list you started yesterday after the Sonnet 5 news. That list should now have at least two dates on it, and the habit of keeping it is worth more than either entry.
— The Vibe Gate news desk. We read the firehose so you can keep building.