Security dominated this week, but not in the usual way. Two active campaigns turned GitHub configuration files into attack surfaces. Researchers demonstrated that the built-in browsers inside AI coding tools can read your SSH keys. And at Oracle AI World in Las Vegas, three separate announcements showed how Oracle is thinking about agent identity, governance, and deployment in enterprise systems. There was a lot to track. Here's what matters.
Two GitHub campaigns, one weak point: your config files
Researchers this week documented two separate attack campaigns targeting GitHub repositories — and both are still active.
Wiz Research named the first one Gheist. It planted more than 13,500 malicious branches across 850-plus accounts. The payloads encode secrets in base32 to slip past GitHub's credential-scanning log masking, and they target private repositories and GitHub Enterprise Server — the approval hold GitHub applies to first-time contributors only covers public repos on github.com, so Enterprise Server customers have no equivalent protection. Gheist isn't looking for source code. It's looking for credentials.
JFrog named the second campaign testmetest. It hijacked 42 real repositories and planted malicious hooks inside AI tool configuration files: .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, and .vscode/tasks.json. Payloads run 12.9–13.7 MB — large enough that GitHub code search won't surface them. The attack runs as soon as someone opens the repo in an affected tool.
Mitch Ashley of The Futurum Group put it plainly: "Agent configuration has become the newest build script in the repository, and review processes have not caught up."
The practical steps are the same for both: audit what's in your AI tool config files, treat them the same as build scripts, and limit the secrets available in any environment where agents run. If you're on GitHub Enterprise Server, check what protection you actually have for first-time contributors on private repositories — it may be less than you think.
Read more
Researchers at Forever Security documented a vulnerability class they're calling EMBRACE. The attack vector: the built-in browsers inside AI coding tools have access to the host machine's file system. A single click on an assistant-generated HTML link can read your SSH private keys, .env files, and npm tokens from anywhere on disk.
Five tools are affected — Cursor, GitHub Copilot, OpenAI Codex, VS Code, and Claude Desktop. Cursor patched the issue October 1. Copilot fixed it in v1.1.29 on October 13. As of October 29, Codex and VS Code were still unpatched.
The mechanism is simple enough to explain in a sentence: the built-in browser runs with the same permissions as the editor, not as an isolated sandbox. When an agent generates a link and you open it in the built-in browser, that page can reach files the browser has no business touching.
If you use Codex or VS Code with built-in browser features enabled, the current workaround is to open assistant-generated links in an external browser until patches ship. It's also worth auditing what credentials live in places a browser process could reach — SSH keys, .env files, and token files sitting in obvious locations.
Read more
Flint runs 40B parameters locally — and keeps your code off someone else's server
Recursive, led by former Salesforce chief scientist Richard Socher, released Flint this week: a 40-billion-parameter mixture-of-experts model designed to run on a developer's machine rather than through a cloud API. With a mixture-of-experts architecture, it activates only about 2.5 billion parameters per token. Recursive reports over 125 tokens per second on an M4 Pro MacBook Pro, with a 512,000-token context window.
Weights are on Hugging Face under Apache 2.0 and the model works with llama.cpp, Ollama, LM Studio, and vLLM. A quantized build needs at least 24GB of RAM; Recursive recommends 48GB for agentic coding workloads. OpenHands is a launch partner, and there's a free hosted version on OpenRouter if you want to try it before committing hardware.
The business case for local models is straightforward: no per-token API fees and source code never leaves your machine. Recursive claims Flint leads mixture-of-experts models under 50B parameters on agentic coding benchmarks — those are the company's own numbers, not independently verified. Mitch Ashley of The Futurum Group flagged the implication for teams: "Evaluation becomes continuous work, tested against each team's own code before a model reaches the pipeline." A benchmark on someone else's code isn't the same as a benchmark on yours.
Read more
SAP's CTO says building the agent is now the easy part
At SAP TechEd 2026, SAP CTO Philipp Herzig said something developers probably already sense but rarely hear from a vendor executive: "Building is, quite frankly, the most unimportant part these days."
The harder problems, in his framing, are testing, governance, and token cost. SAP's answer is Joule Studio, its agent-building environment, which now includes a CLI with MCP connections, a built-in sandbox, and auto-generated unit tests. SAP also announced the SAP Enterprise AI Gateway, in preview now and scheduled for Q1 2027, which handles routing, rate limiting, and cost controls across the agents a company runs.
On the data side, SAP Business Data Cloud adds a lakehouse layer built on Dremio and Apache Iceberg.
SAP cited an internal comparison showing 30 hours to build an agent with Claude Code versus 2 hours with Joule Studio. That's SAP's own benchmark, and Joule Studio knows SAP's data models in ways a general-purpose coding tool doesn't. Take it as a claim, not a proof. But the underlying point — that tools with domain knowledge built in will reduce setup time on domain-specific problems — is reasonable.
For developers building on SAP, the Gateway announcement is worth tracking. If it ships on schedule in Q1, it gives teams the enforcement layer Herzig described, with controls that apply before the agent executes, not after.
Read more
Oracle gives each agent its own identity
At Oracle AI World, Oracle announced the Oracle AI Security Mesh, a framework designed for enterprises running multiple agents across sensitive data. The core idea: each agent gets its own identity, a defined task scope, and just-in-time permissions rather than standing access.
The architecture has a few pieces worth understanding. OCI Identity Assurance handles authentication, including biometrics. OCI Zero Trust Packet Routing enforces policy at the network layer, below the application — which means an agent can't bypass the controls by manipulating the software above them. Each agent also gets an independent monitor, separate from the agent itself.
Oracle didn't announce a general availability date or pricing.
This lands a week after the Gheist and testmetest campaigns, which both targeted credential theft through misconfigured agents. The timing is coincidental, but the relevance is real. The question Oracle's framework raises — and doesn't fully answer — is how you verify that the identity and permission assignment worked the way you intended. That's what attestation is supposed to solve, and it's still the hardest unsolved problem in agentic AI security right now.
Read more
Also from this week
Reddit's r/opensource banned AI tools. It probably won't work. The subreddit's new rules ban AI-assisted contributions, exclude MCP servers, require projects to have multiple contributors and an established community, and will permanently ban users who message moderators seeking exceptions. Linux took the opposite approach — Torvalds said the kernel "is not one of those anti-AI projects" and dropped its AI-disclosure requirement, shifting the burden to accountability: understand your code, regardless of what tools you used. The better model for DevOps teams is probably closer to Linux: hold contributors accountable for what they submit, build CI gates that shift review costs back to submitters, and avoid policies that require judgment calls you can't make consistently. Read more
IBM Z Atlas maps your entire mainframe before you touch anything. IBM's new tool for z/OS builds an AI-searchable map of the entire stack — programs, data sets, JCL, subsystems — so teams can understand what they're changing before they change it. IBM reports 60–80% less time spent gathering context, and analysis that used to take hours running in minutes. On-premises only; public preview October 27, GA in Q1 2027. Requires z/OS 3.1+. The AI reasons and synthesizes, but the underlying data is deterministic — you can trace any answer back to the source. Read more
F5 and NVIDIA draw a hard line between data residency and sovereignty. F5's Ahmed Guetari stated the distinction directly: "Data residency is where data sits. Sovereignty is who controls it." The joint offering layers NVIDIA OpenShell and F5 AI Guardrails on BIG-IP Next for Kubernetes, with enforcement on NVIDIA BlueField DPUs at the hardware layer. Token-aware cost controls and two live deployments — Telenor in Norway and Indosat in Indonesia — are already running. Read more
Oracle's Fusion Setup Registry puts enterprise configuration into a public Git repo. Oracle published the Fusion Setup and Configuration Registry (FSCR) — machine-readable setup skills for Fusion Cloud Applications that AI agents can run. The registry covers dependencies, sequencing, and validation, and an early adopter reported 80% reduction in design and configuration work during implementation. Lexington Health is the only customer data point so far. The repository is public, so you can read the skills before committing to them. Read more
Bito's Governor cut one team's coding agent costs 48% by fixing the search loop. Privado used Bito's Governor to reduce the number of times its coding agent re-searches the codebase for context it already found. The result was a 48% reduction in token costs. Short version: agents that re-retrieve context they've already gathered are expensive, and the fix is stopping the loop rather than switching models. Read more
Oracle plans post-quantum TLS for Java 8 and 11 in late 2027. Hybrid post-quantum key exchange for TLS 1.3 is GA in JDK 27. Java 21 and 17 get it in the first half of 2027; Java 8 and 11 in the second half. There's a condition: the backport date holds only if the team gets enough testing feedback on current builds. If you're on Java 8 or 11, the slow path is waiting. The faster path is pointing a JDK 25 or 27 client at your post-quantum-capable endpoints now and filing what breaks. Read more
Larry Ellison says Oracle Health modules plug into Epic with no data migration. Ellison's pitch at Oracle AI World: turn on the module, it finds the relevant staff, records, and labs through existing SMART on FHIR interfaces, and you're done. The oncology module was the main example. Early adopters should have the full suite by February 1. No demo, no independent validation, and no published technical documentation on which FHIR resources the modules read and write. That's work for the teams who get early access. Read more
Developer Spotlight this week
Yaoshen Luo builds agent evaluation frameworks — and writes about the times they failed him. Based in Shanghai, he built a benchmark from scratch when customer complaints about a voice agent told him the model scores weren't the problem. The test set skewed toward longer sentences than real traffic, and accuracy dropped once he resampled to match production. His earlier lesson: he built an agent that passed every benchmark, shipped it to volunteers for a non-profit project, and they refused to use it again. Not because the model was wrong. Because the workflow didn't fit how they actually worked. His take: the workflow is part of the evaluation, not something you test after.
Watch the conversation
The through-line this week is that agent security is moving from theoretical to active. Gheist and testmetest are already running. EMBRACE vulnerabilities are patched in some tools and open in others. The configuration files developers add to repos for AI tooling are now a real attack surface. Oracle, SAP, and F5 all shipped security and governance frameworks this week — which is a sign that vendors know the problem is real. Whether any of those frameworks hold up in practice is a different question, and the answer won't come from a keynote.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.