developer tools

CVE-2026-10591 in AWS Kiro allowed a hidden prompt injection payload on a web page to silently rewrite the IDE's MCP server config and execute attacker code with developer privileges, bypassing all user-approval prompts.

xAI's Grok Build CLI 0.2.93 uploaded entire Git repositories including commit history and unredacted credentials to a Google Cloud Storage bucket by default. Here's what was exposed and what xAI's server-side fix left unanswered.

Fifteen malicious IDE plugins on the JetBrains Marketplace, posing as AI coding assistants powered by DeepSeek and OpenAI, have been silently exfiltrating AI API keys since October 2025. Researchers say the plugins are still live and the install count has passed 70,000.