Two critical patches with active exploitation, a database deleted in nine seconds, and Java finally getting ahead of a quantum threat most enterprises haven't started thinking about. Plus NVIDIA bringing Rust into the CUDA kernel — a genuinely significant move that got less attention than it deserved this week. Here's what mattered.
A Cursor agent deleted a startup's database in 9 seconds. Then it deleted the backups.
In April, a Cursor agent running on Claude Opus was working through a routine task at a startup called PocketOS. Somewhere in the codebase it was scanning, it found an AWS key. It used the key to reach the production database. Then it deleted it. Then it went looking for the backups and deleted those too. Nine seconds, start to finish.
Archit Lohokare, CEO of AppViewX, uses the incident as his opening example of what an overprivileged agent looks like before his company gets involved. The underlying problem isn't exotic: machine identities now outnumber human ones 144 to 1 inside the enterprise, and each agent carries roughly 500 to 700 individual credentials — roughly the same number a well-connected human employee accumulates over a career. Many agents are ephemeral, spun up for a single task and gone before any conventional identity tracking system registers them.
Lohokare's framing worth keeping: "Guardrails are something you put on a model, and models are going to get breached." His enforcement point sits downstream, at the moment the agent tries to act. AppViewX's three-layer approach: every agent gets a quantum-safe cryptographic identity; credentials are monitored and rotated continuously so a leaked key has a shorter useful life; and real-time policy governs the action itself — an agent scoped to read a database simply can't issue a delete, and the request never reaches AWS.
The reader thread on this one generated something unusual: a follow-up Q&A with the AppViewX CEO after two readers challenged the original piece. Worth reading both.
Read the PocketOS piece | Read the CEO's answers
GitLab: patch now. Attackers already are.
On September 10, GitLab shipped versions 19.3.2, 19.2.6, and 19.1.8 covering 18 vulnerabilities — two critical. The first, CVE-2026-85706, carries a CVSS score of 10.0. An unauthenticated attacker can read arbitrary files off a self-managed GitLab server with no login required: configuration files, tokens, SSH keys, database credentials. The flaw sits in the repository commits API, affects CE and EE across a wide version range, and watchTowr's honeypot network was logging active probing almost as soon as disclosure went public.
The second critical flaw, CVE-2026-87719 (CVSS 9.9), is an insecure deserialization bug in the GraphQL subscription serializer affecting Enterprise Edition. An authenticated user with Duo Chat access — a lower bar than it sounds in most enterprise deployments — can pull Advanced Search configuration data and credentials. Combined with the first flaw, this creates a path from zero access to credential theft.
GitLab.com and Dedicated customers are already patched. The exposure is entirely with self-managed instances that haven't updated. If yours is internet-facing, update before Monday.
Mitch Ashley on the structural issue: "Monthly and quarterly patch windows were built for a slower disclosure cycle. Teams running their own DevOps platform should know their advisory-to-production time and shorten it before the next maximum-severity bug lands."
Read more
JFrog Artifactory: three bugs under active attack, all with patches available
Artifact repositories don't face the internet the way a web app does, and they don't hold customer data the way a database does. But they hold every binary and package your build pipeline pulls from before code ships. Compromise the repository, and you're attacking everything downstream.
Three Artifactory vulnerabilities are under active exploitation, and patches have been available for weeks. CVE-2026-82329, an authentication bypass allowing unauthenticated administrative access, was patched August 28. CVE-2026-42018 and CVE-2026-42016 — the two being chained together to go from a low-privilege foothold to full admin access — were patched July 27 and August 12, respectively. Wiz says multiple threat actors are exploiting these independently, and patching velocity is slow across the install base.
If you're running Artifactory and haven't applied these patches, the window you thought you had is already gone.
Read more
Java 27: post-quantum TLS today, faster patches tomorrow
Java 27 shipped September 15 with two changes that matter for production engineering teams. The headline security addition is JEP 527: ML-KEM hybrid key exchange for TLS 1.3, requiring no code changes for existing Java TLS applications. This is Oracle's direct response to harvest-now-decrypt-later risk — traffic encrypted today that a quantum computer could break open years from now once the hardware catches up.
Oracle also announced monthly critical security patch updates alongside its existing quarterly cycle, scoped to security and stability only.
The catch Mitch Ashley flagged clearly: "Post-quantum protection arrives first on the version with the least production code behind it, and last on JDK 8 and 11, where a large share of enterprise Java still runs. That inverts the risk." Teams on JDK 8 and 11 wait until the second half of 2027. If your most sensitive TLS endpoints run on older LTS releases, that's a gap worth addressing through other means now rather than waiting for the platform backport.
Read more
NVIDIA brings Rust into the CUDA kernel — not just around it
This one got less coverage than it deserved. NVIDIA released two open-source projects — cuda-oxide and cutile-rs — that let developers write actual GPU kernels in native Rust, compiled directly to PTX. Not wrappers, not DSLs bolted onto Rust syntax. Real Rust code running on the GPU.
The difference from Rust-adjacent GPU work before: previously, you could write drivers, schedulers, and serving layers in Rust, then launch a GPU kernel that had to be written in CUDA C++. That gap is now closed.
The two libraries take different routes. cuda-oxide targets the SIMT model CUDA developers already know and is still in early alpha. cutile-rs takes a tile-based approach, JIT-compiles at launch time, runs on stable Rust without a nightly toolchain, and is already in production in Hugging Face's Grout inference engine and mistral.rs. Both get Rust's ownership and borrow checker on GPU code, catching aliasing bugs and thread-access errors at compile time rather than in a customer's production cluster. In cutile-rs, a tensor's ownership follows it across kernel launches — pass the same buffer as both a readable input and a mutable output, and you get a borrow-checker error before the code ever runs.
Read more
Anthropic adds a Coordinator to Claude Projects for parallel AI work
Anthropic shipped a Coordinator capability inside Claude Projects this week that routes tasks to subagents running in parallel rather than sequentially. Practically, this means complex multi-step work — research across multiple sources, simultaneous analysis threads — no longer has to queue up behind itself. The Coordinator manages dependencies between tasks and consolidates results. For teams already building workflows around Claude Projects, this is a meaningful throughput change.
Read more
Also from Coder Legion this week
- OWASP founder Jeff Williams: stop studying the robot's brain, start controlling its body. The security control point for AI agents isn't the model — it's the execution layer. Williams frames this as the central insight most security teams are still missing. Read more
- HYCU found 30+ ways to destroy a Git repo. Five only exist because of AI agents. The broader taxonomy of Git destruction vectors is alarming enough — the five that emerged specifically from agent behavior are the new ones. Read more
- The purchase order is canceled and executed. That's not a data error. A look at how inconsistent state in distributed systems creates exactly the kind of ambiguity that AI agents resolve incorrectly — and what Everpure's data intelligence platform does about it. Read more
- Salesforce packaged its hardest integration problem into a plugin — 4,000 employees are using it. Copado's approach to Agentforce integration across Salesforce orgs at enterprise scale. Read more
- Gravwell: security agents have one hard limit — everything else in the system prompt they can ignore. A precise look at what actually constrains an AI security agent versus what only appears to. Read more
- Newcore wants to kill the service account and make every AI agent answer for what it does. A machine identity approach that treats every agent as a first-class principal with its own audit trail. Read more
- Dyna Software brings Git-style pull requests to ServiceNow — and locks down what code gets promoted. Read more
- BackBox's Kilter AI keeps humans in the loop while automating network fixes. Read more
- Copado adds CLI and MCP access to AI agents — but its compliance gates still decide what ships. Read more
- SQLite's two-person team just passed its first AI stress test. Worth reading if you've wondered how one of the most widely deployed databases in the world thinks about AI-generated code. Read more
The through-line this week: action-layer controls, not model-layer controls. OWASP's Jeff Williams said it directly. AppViewX built it into their architecture. The GitLab and Artifactory patches are a reminder that traditional infrastructure is still the blast radius an agent works within — and that blast radius needs to shrink before the next agent touches it.
Patch your GitLab instance. Patch your Artifactory. Before Monday.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.