Do Not Let a Free Model Author the Agent Allowlist
This story is from 2026-09-12. It is preserved in the archive; the latest stories are on the live feed.
The on-call channel lit up at 02:11 UTC. This scene is a composite of common control-plane leaks. A coding agent had written a new MCP tool descriptor. No human pull request existed for that change. The descriptor widened an exec tool to an unbounded shell. The free-tier completion read as fluent,…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-12 17:41 · DEV Community — AI
Do Not Let a Free Model Author the Agent Allowlist