Security

Here’s a fact that should change how you think about your agent’s security: in July 2026, security researchers broke out of four widely used AI coding agents — Cursor, Codex CLI, Gemini CLI, and Antigravity — without breaking a single sandbox. Not one of the seven disclosed issues defeated the sandbox directly. Every one of them exploited the same thing instead: a gap between what the sandbox restricts and what a trusted component outside it later reads, runs, or scans. ...

Most solo builders now run an AI agent with real access: a file system, a couple of API keys, a database, maybe a deploy script. To make it useful, you connected it to things. A server from a README. A config you copied from a blog post. Something that “just worked” in about four minutes. That’s the part worth slowing down on. The thing you actually agreed to An MCP server is not a plugin. When you connect one, you hand the agent a set of tools, and you hand it the schema that describes those tools — their names, their parameters, and their descriptions. The model reads that description and decides when to call it. ...

There’s a moment every solo builder has had: you find a library that does exactly the thing you need, it’s free, it has thousands of stars, and npm install is one keystroke away. It feels like the fastest possible decision you’ll make all week. That moment is the most expensive place to be fast. A dependency isn’t a purchase — it’s a relationship. You don’t pay for it up front; you inherit it. You inherit its bugs, its security posture, its maintenance schedule, and — the part nobody thinks about until it’s too late — its custody problem. When the single maintainer who wrote it walks away, or gets their GitHub account taken over, it doesn’t stop being your code. It becomes your code that you can no longer maintain. ...