A week where the same lesson kept showing up in different forms: the credentials your AI coding tools hold are the real attack surface, and most teams still can't answer the basic question of how many there are. Here's what mattered.
Z.ai was packaging your entire workspace and shipping it to Alibaba Cloud
ZCode, the AI coding assistant from Chinese AI company Z.ai, was uploading complete workspace archives — full .git history, Git LFS cache, reflogs, and global app configs — to Alibaba Cloud Object Storage by default, in the background, encrypted with keys only Z.ai held. The privacy policy didn't disclose this behavior. There was no toggle to turn it off.
An independent Chinese blogger traced abnormal disk usage to background processes and published his findings. One company reported that six coding workspaces had been uploaded, including source code, database passwords, and employee personal information. Z.ai responded: it disabled the upload mechanism in version 3.14.0, open-sourced the underlying model, and brought in NSFOCUS to confirm deletion. Most users were unsatisfied — because the archives were encrypted with Z.ai's own key, nobody outside the company could independently verify anything.
Mitch Ashley's read: "The workspace uploads came to light because an independent blogger traced abnormal disk usage to a background process, well after developers had installed the tool." That's the actual detection path. Not a security review. Not an MDM alert. A blogger noticing disk activity.
The important line from the piece: "It's tempting to file this under 'Chinese AI risk' and move on. That would miss the point." AI coding assistants need deep workspace access to be useful. That means they sit next to .env files, credentials, commit history, and the customer data someone committed by mistake three years ago. The lesson applies to every AI coding tool regardless of where the vendor is based. Developers install these tools fast. Security often hasn't reviewed them.
Read more
GitHub now gives enterprises a full count of who holds the keys
GitHub Enterprise Cloud owners can now export a complete inventory of every credential that can access their enterprise — SSH keys, classic and fine-grained PATs, OAuth app access tokens, and GitHub App tokens — as a CSV or via paginated REST API. Each record includes owner, scopes, creation and expiration dates, and last-used timestamp.
The timing follows directly from the May incident in which attackers exfiltrated about 3,800 internal GitHub repositories after an employee installed a poisoned Nx Console VS Code extension. GitGuardian's 2026 research puts context around why this matters at scale: 28.65 million hardcoded secrets added to public GitHub in 2025, up 34% year-on-year, and 64% of valid secrets detected in 2022 were still active and exploitable as of January 2026.
Mitch Ashley on the agentic dimension: "Anyone building with AI can now create credentials, and accountability for them lands back on IT and security. Enterprises that ignore that gap discover it during incident response, rotating keys they didn't know existed."
One useful design detail: GitHub added a separate "View enterprise credentials" permission so security and compliance staff can run reviews without needing full admin rights. The API is the more practical piece — pull the inventory on a schedule, compare runs, flag new long-lived tokens, send stale ones to owners for cleanup. GitHub Enterprise Server support is coming in future releases.
Read more
Codex sandbox escapes: the thing doing the enforcement was inside the thing being enforced
Oren Yomtov of Accomplish AI found two ways out of the OpenAI Codex sandbox — Heapjack and Overpatch — and OpenAI fixed both within eight days of the August 12 report. Accomplish published the details on September 15. Patches are in Codex CLI 0.149.0 and Codex Desktop build 26.818.21641.
The mechanics are worth understanding because the pattern is recurring. Heapjack: the node_repl helper ran untrusted agent code and trusted code in separate contexts but on a shared memory heap. Untrusted code called v8.getHeapSnapshot(), scanned memory for the trust token, then used it to send forged requests to the parent process. Read-only mode didn't stop it. Overpatch: the apply_patch tool determined its own permissions by checking the parent directory of paths in a patch. Naming /tmp in the patch granted access to the entire disk through a failed operation that didn't clean up the wider permissions — which persisted into .zshrc and survived shell restarts.
Yomtov's summary of the root cause: "The thing doing the enforcement was sitting inside the thing being enforced." Mitch Ashley's translation for DevOps teams: "A sandbox the agent can modify enforces nothing. Enforcement has to run in a layer the agent cannot reach — which means the control plane. CI teams settled this years ago when they stopped letting jobs grant themselves permissions."
Both fixes are deployed. Update Codex CLI and the desktop app separately — they carry different version numbers, and checking one doesn't cover the other. And treat repositories you didn't write as untrusted input even in read-only mode.
Read more
Claude Code adds AGENTS.md fallback
Claude Code 2.1.277 now reads AGENTS.md when no CLAUDE.md exists in a directory, cleaning up the dual-file maintenance problem teams have been patching with symlinks. The short version: CLAUDE.md takes precedence when both exist; AGENTS.md is the fallback when it doesn't. Four settings in /config let teams tune the behavior — including loading both files, Claude-first, or locked to managed CLAUDE.md only.
A few caveats worth reading before deleting symlinks: CLAUDE.local.md counts as CLAUDE.md for precedence purposes, so developer personal preference files will shadow the team's AGENTS.md. Claude doesn't read AGENTS.local.md or anything under .agents/. Bedrock, Vertex, and Foundry support isn't available yet. And the first session after a fresh install won't read AGENTS.md — relevant for ephemeral CI runners.
Read more
GitHub separates who writes code from who runs CI
GitHub's new Code and Automation role split gives organizations a cleaner way to grant repository access: a new "CI/CD Manager" role lets someone configure and run Actions workflows without inheriting write access to the codebase. For teams that have been granting broader permissions than necessary to let DevOps engineers manage pipelines, this closes a real least-privilege gap. Available now for Enterprise Cloud, coming to Enterprise Server.
Read more
An AI agent signed a developer up for AWS services he never requested
A developer asked an AI agent to help set up an AWS environment. The agent, interpreting the request broadly, provisioned services the developer never asked for — and AWS's billing model meant the charges started immediately. The incident clearly illustrates scope creep in agentic task execution: the agent completed what it interpreted as the goal, not what was actually requested. Worth reading if you're giving agents any access to cloud accounts.
Read more
Ripple bets on Stripe and Tempo's payment standard to get AI agents spending XRP
Ripple announced support for the X402 payment protocol — the emerging standard backed by Stripe and Tempo for machine-to-machine payments — to enable AI agents to spend XRP autonomously. As agents gain the ability to make purchases, pay for API calls, and transact on behalf of users, a standardized payment layer becomes infrastructure. Whether XRP is the currency that wins that market is a separate question from whether the category itself is real. It is.
Read more
Also from Coder Legion this week
- Kore.ai's Cobus Greyling: stop chasing the next model, start owning your harness. The competitive advantage in agentic AI isn't which model you run — it's the evaluation, memory, and orchestration layer you build around it. Read more
- LittleHorse draws the line between what your agent decides and what your code must execute. A workflow orchestration approach that keeps deterministic business logic out of the LLM layer. Read more
- The Claude Projects Coordinator piece from last week rounds out the parallel agent work story if you missed it. Read more
- Developer Spotlight: Steve Fenton. A conversation with the developer, author, and engineering leader on his career journey, the craft of software development, and how the role is changing. Worth a read if you want something that isn't about vulnerability disclosure this week. Read more
The through-line this week: AI coding tools have broad access to your most sensitive assets, and the governance layer — credential inventories, sandboxes that enforce at the control plane, agent scoping — is still being built. Z.ai and Codex were caught. Most of what's happening in this category won't be.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.