AI Coding Live News

Modern AI coding agents such as Claude Code, Codex, and terminal assistants routinely execute agent skills—instructions and executable scripts bundled in SKILL.md specifications—with full local user privileges. Developers share these skills primarily by copying files across repositories, inadvertently forging a shadow software supply chain without centralized registries, semver tagging, or provenance tracking. A seminal empirical audit by Fahd Seddik (arXiv:2610.11169) introduces Skill Constellations, constructing the first dated copy network of agent skills derived from git provenance across 2,193,119 skill adoptions on GitHub. The investigation demonstrates that a minuscule set of root repositories generates nearly all downstream copies, yet GitHub star counts correlate poorly with true lineage sources. Critically, downstream copies almost never adopt upstream security patches. By fitting a predictive copy network model, auditing just the top 100 identified root repositories halts 14.9% of subsequent high-risk skill adoptions (compared to a negligible 0.5% when inspecting the top 100 starred repos), proving the urgent necessity for decentralized package ecosystems to adopt versioned references over loose copies.

@DanKornas shipped lpm (github.com/gug007/lpm): an MIT native macOS desktop app that keeps project services, terminals, and AI coding agents in one workspace—one-click start/stop with live terminal output, duplicate projects for parallel feature work, profiles for service subsets or one-off test/migrate/deploy actions, and native (no-Docker) service management beside Claude Code, Codex, and other agents.

@DanKornas ships brief (github.com/git-pkgs/brief): an MIT single-binary CLI for contributors and AI coding agents that detects language, package manager, test/build/lint/formatter conventions; accepts local paths, Git URLs, and registry packages; can narrow reports to changed files; emits human or JSON output; and adds inspection commands for native artifacts, tooling gaps, and threat categories.

Cybersecurity researchers disclosed a critical zero-click remote code execution vulnerability impacting Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw exploits weaponized repo metadata during autonomous indexing, spurring an industry-wide push for strict containerization.

Perplexity says two engineers worked with hundreds of AI coding agents to build CobbleDB, a custom Rust database replacing DynamoDB reads in its search stack. The case shows coding agents contributing at real infrastructure scale while keeping production execution outside the agents’ permissions.

Reports say Google released a free Google Cloud Developer Plugin so AI coding agents can use official cloud knowledge and tools (project setup, auth, gcloud, docs) instead of guessing GCP workflows. Claude Code install: claude plugin marketplace add google/skills, then claude plugin install google-cloud-developer@google-plugins; Codex CLI and Antigravity have their own install paths. The plugin is free; normal GCP/API usage still bills separately.

Dan Kornas (@DanKornas) launched MIT open-source VibeDrift: a code-integrity tool for AI coding agents that parses and scores repo patterns locally. Use CLI scans, let agents query an MCP server, or run Drift Sessions during edits; supports JS/TS, Python, Go, and Rust, plus near-duplicate and security-consistency checks.

Open-source (MIT) macOS terminal kooky is built for AI coding: sidebar workspaces and split panes, one-click built-in or custom agent sessions, live running/waiting/failed states, plus git worktrees, SSH workspaces, session history, and kooky-cli for scripted tab control.

Cloudflare announced an edge-native runtime for AI agent builders. Integrating Workers AI with D1 relational storage and Vectorize vector indexes allows agent workflows to maintain session state, semantic recall, and model inference across 330+ global edge locations with sub-50ms latency.