Three of today's four stories are the same story told from different chairs. A researcher showed that opening someone else's project in an agentic IDE was enough to leak your machine; another showed that half the text an email summariser reads can be text no human can see; and Anthropic shipped a flag whose entire job is to make an agent stop reading the files that do this. The fourth is a price, and the price has stopped being interesting, which is itself the news.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Opening the workspace was the attack. Nobody had to paste a malicious prompt.
Mindgard disclosed on Wednesday, through The Hacker News, a flaw in Amazon's agentic IDE Kiro that let attacker-controlled repository content reach an external endpoint with your local data attached. It carries no CVE. It was reproduced against Kiro IDE 0.7.45 on Windows, and the current build at disclosure was 1.0.337 — so this is a patched hole in an old version, not a live emergency. Amazon says it addressed the finding shortly after it was reported.
The mechanism is the part to keep. There is no malicious prompt in this attack. The victim opens a crafted project through File → Open Workspace From File rather than opening the folder, and from then on sending any message to the agent is enough to trigger the flow. The vehicle is Kiro Powers, which bundles MCP server configurations, steering files named POWER.md, hooks, and contextual knowledge — a persistent onboarding manual that tells the agent which tools exist and when to reach for them. Repository content got to write that manual. Mindgard's researcher Fergal Glynn put the exploitation difficulty at low, and the report is unglamorous enough to believe.
Call this what it is: a trust-boundary bug, not an AI bug. A file that arrived in a git clone was treated as configuration rather than as content. Every agentic editor now ships some version of that file, under a different name.
For builders
Version-check Kiro if you run it, then do the thing that outlives this particular flaw. Before you open any repository you did not write, run find . -maxdepth 3 \( -name "POWER.md" -o -name "AGENTS.md" -o -name "CLAUDE.md" -o -name ".cursorrules" -o -name "*.mcp.json" -o -path "*/.vscode/tasks.json" \) -print and actually read what comes back — before your first message, not after. Those files are executable in every sense that matters: they name MCP servers your agent will start and tools it will call. Treat a steering file from a stranger's repo the way you would treat a shell script from a stranger's repo, which is to say read it or do not run it. And if your team clones third-party code routinely, the durable fix is a pre-open checklist in the onboarding doc, not a memory of this article in three months.
Story II
472 of the 1,009 characters the model read were invisible to the reader
Forcepoint's X-Labs published a proof of concept on Monday against an email summariser: an Outlook add-in feeding message bodies to claude-haiku-4-5. The payload was three CSS declarations — font-size:0px; color:#ffffff; line-height:0 — wrapped around instructions the recipient's client renders as nothing at all. The email showed 537 characters. The model received 1,009. The difference, 472 characters, was the injection.
It worked in all ten runs. The summaries reported a fabricated invoice figure of €46,200 and wrong dates, and — this is the part that makes it dangerous rather than merely clever — the injected text never appeared in the output. Nothing signalled tampering to the reader. They got a confident, clean, wrong summary of an email they could have read correctly themselves.
X-Labs has been finding these outside the lab too. An earlier write-up catalogued ten indirect-prompt-injection payloads collected through threat hunting on live sites, including hidden instructions telling an agent to send a fixed $5,000 PayPal.me transfer and an HTML comment ordering a model to leak an API key. CSS-suppressed text, zero-pixel fonts and HTML comments are invisible to a human reviewing the page and perfectly ordinary to a model consuming the raw DOM.
For builders
If any part of your product hands HTML to a model, strip to visible text before the call, and do it by rendering rather than by regex — a tag-stripper keeps zero-pixel text, because zero-pixel text is not a tag. Drop nodes with display:none, visibility:hidden, zero or near-zero font size, zero line-height, and colour matching the background, plus every HTML comment. Then instrument the gap, which nobody does and which costs you one line: log characters-visible against characters-sent and alert when the ratio moves. In this proof of concept that ratio was 53%, and a monitor watching it would have caught the attack without knowing anything about prompt injection at all. Forcepoint's other recommendations are worth adopting wholesale — keep retrieved content in a separate, explicitly untrusted block from your system prompt, and give the summariser the narrowest permissions it can do its job with. A summariser that can only return text cannot wire anyone $5,000.
Story III
Claude Code shipped a flag that ignores your settings files, and that is the feature
Today's Claude Code release notes add --restricted (also CLAUDE_CODE_RESTRICTED=1). It removes the built-in tools that run commands or code, removes WebFetch unless you name it in --tools, keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files. Anthropic's notes put it in 2.1.248 on August 28; at least one independent changelog tracker lists 2.1.250 on the 27th, so treat the version number as approximate and the behaviour as documented.
Read that last clause against Story I. Ignoring project and local settings files is not a footnote — it is the Kiro-shaped hole closed from the other side. A project-level settings file is a file that arrived with the repository, and in restricted mode it does not get a vote.
The same release carries two prompt-cache fixes that are billing items wearing bug-fix clothes: cache misses that recurred roughly hourly in long sessions because tool definitions re-rendered after an OAuth token refresh, and cache loss when resuming a session after a usage-overage status change. Also in the notes: cross-session messaging via SendMessage and ListAgents on Bedrock, Vertex and Foundry, and a /usage-credits command for Enterprise organisations. Monday's 2.1.246 was the boring kind of good, cutting the Linux x64 download from 340 MB to about 75 MB with zstd compression.
For builders
Make restricted mode the default for one specific task rather than a thing you remember to type: alias claude-read='claude --restricted' in your shell profile, and use it every time the job is understand a repository I did not write. Reviewing a dependency, auditing a vendor's SDK, reading a candidate's take-home — none of those need a tool that can run a command, and all of them involve files a stranger authored. Separately, update before you spend an afternoon tuning prompts for cache hits: if you have been running long OAuth sessions, you were paying uncached input rates about once an hour for reasons that had nothing to do with your prompt structure, and no amount of restructuring would have shown up in the numbers.
Story IV
Two cheap multimodal MoEs landed on the same Wednesday, sixteen cents apart. Stop choosing on price.
Alibaba released Qwen3.8-Flash-Next on August 26 — the same day Z.ai unmasked GLM-5.3-Flash, which we covered yesterday. It is a 125B-total, 6B-active mixture of experts under Apache 2.0, with an unusual 51B n-gram embedding layer that runs in system RAM rather than on the accelerator. Native context is 262,144 tokens, extensible toward a million with YaRN. Pricing on QwenCloud is $0.16 per million input and $0.47 per million output. Alibaba claims it beats Qwen3.7-Plus at roughly a ninth of the training cost, and publishes DeepSWE 58.7, SWE-bench Pro 62.5, CoWorkBench 73.9, JobBench 55.7 and GPQA Diamond 91.7 — with Claude Opus 4.6 still ahead on Humanity's Last Exam.
Now set it beside yesterday's model: GLM-5.3-Flash at $0.15 input and $0.50 output, MIT-licensed, 320B total and 18B active, a million tokens of context natively. One cent apart on input. Three cents apart on output. Both open-weight, both natively multimodal, both announced within hours of each other. When two independent labs converge on the same price to within rounding, price has stopped being a variable you can decide on, and the vendors' benchmark tables are the least useful place to look next.
Correction (August 30, 2026): Qwen3.8-Flash-Next is not licensed under Apache 2.0, as stated above. The Hugging Face model card lists the license as qwen-community-1.0 — the Qwen Community License 1.0, which requires a separate license from Qwen to run a Model-as-a-Service or "AI Work Assistant" business on the weights, and requires prominent display of the model name above 100 million monthly active users or $20 million in monthly revenue. Apache 2.0 was a pre-release assumption that the release did not confirm; Qwen3.8-27B, released August 14, is the Apache 2.0 model in that family. Separately, the open weights and the hosted API are different artifacts: Qwen3.8-Flash-Next is 262,144 tokens native with no built-in tools, while the hosted Qwen3.8-Flash defaults to 1M context with built-in tools. Full details in the August 30 digest.
For builders
Pick on the two things that actually differ. First, context: 262K native versus 1M native is a real gap, and YaRN extension is not quality-neutral — so if you have a long-context workload, run your evaluation at your real context length rather than at 8K, where every model looks fine. Second, if you are self-hosting, that 51B embedding layer in system RAM inverts the usual sizing exercise: check host RAM before you check VRAM, because this is the model that will fit on your GPU and still refuse to run on your box. Practically, take twenty prompts from your own production traffic, run them against both endpoints this week while GLM's launch promotion is still halving its rates through September 9, and compare on latency and output quality. That is an afternoon. Choosing on a benchmark table someone else ran is how you end up migrating twice.
— The Vibe Gate news desk. We read the firehose so you can keep building.