Coding agents draw attackers while Anthropic files for an IPO

Coding agents become the target

The risk around coding agents now sits in what they read and what they are allowed to do. Flatt Security demonstrated poisoning Claude Code through a single GitHub issue, exploiting an agent that treats repository content as context it can act on. The researchers argue for sandboxing and provenance checks before an agent follows repo-sourced instructions. That fits a VentureBeat analysis arguing that the bottleneck for enterprise agents is permissions rather than model performance. In its view, deciding which data, systems and actions an agent may touch is an access-control problem, and IAM tooling may matter as much as model choice.

Other attacks go after the people using these tools and the conversations they hold. Threat actors set up spoofed Anthropic sites that deliver a fileless infostealer to Claude Code users, so install channels deserve the same care as package registries. A tool called LLMReaper scrapes AI chat conversations from the page DOM via malicious browser extensions, which sidesteps network-layer protections. Below the browser, researchers described websites profiling visitors by analyzing SSD activity, a tracking vector that cookie blocking does not touch. For background on how deep these channels go, lcamtuf's short explainer that a process's memory can be read like a file is a useful refresher.

More reviewing, less typing

One developer's account of working with Claude describes spending less time coding and more time testing, with their hours moving toward reviewing what the model produces. Larger agent-written diffs make that review harder, and a detailed post shows how Jujutsu can split and restructure large changes for review after the fact, something Git workflows handle less gracefully.

Tool vendors are pulling non-engineers and scattered surfaces closer to the codebase. Figma's latest updates let designers work against a production codebase in Figma Make with visual edits, annotations and Git-based workflows. Microsoft appears to be consolidating too: leaked screenshots of a Copilot super app show tabs for GitHub Copilot, a collaboration feature called Cowork, and one called Scout. The screenshots are unconfirmed, and Microsoft has not shipped the app.

Anthropic faces markets and close readers

Anthropic submitted a confidential draft S-1 to the SEC, a standard step for a company that plans to go public while keeping its financials private until closer to launch. A filing is not an offering, but an IPO would likely put more attention on inference and serving costs.

Claude Opus 4.8 is being examined from several directions at once. Zvi Mowshowitz worked through the model's system card and its safety evaluations and followed with a separate essay on model welfare. A widely shared thread claims Opus 4.8 broke ARC-AGI-3, which remains a third-party claim rather than a settled result.

Open models chase simpler deployment

NVIDIA released models for both language and physical agents. It announced Cosmos 3, an open foundation model for physical AI covering robotics, simulation and embodied agents, and separately Nemotron 3 Ultra, its latest large language model. Distribution is shifting as well: MiniMax M3 is launching on Ollama Cloud, so developers can run it as a managed service while keeping Ollama's local-first workflow for smaller experiments.