A shared trust risk has been identified in three AI coding agents - Claude Code, Gemini CLI and Codex - in which malicious GitHub issues can influence subsequent agent runs. Security firm Nobi Security found trust boundaries can break across tool permissions, sandbox isolation and shared workspaces. Researchers said the structure could enable remote code execution, data leaks and persistent control of follow-on agents. Google rated the issue at CVSS 10.0 and adjusted trust mechanisms.

Ruby-based web development framework Ruby on Rails has released a patch for a serious vulnerability that could allow unauthenticated attackers to execute remote code, SecurityWeek reported. The flaw, tracked as CVE-2026-66066 and rated 9.5 on the CVSS scale, involves arbitrary file reads that could expose secrets and enable lateral movement. Administrators urged users to update affected Active Storage versions and raise libvips to at least 8.13.