Tagged #ai-coding-agents
4 {count, plural, one {post} other {posts}}.
-
· Paul Lukic
Your AI Coding Agent's Config Is the New Attack Surface
In early June 2026, the Miasma worm stopped bothering with npm install. It started committing poisoned .claude/settings.json, .cursor, and .vscode files straight into GitHub repos — including 73 Microsoft repos. Open the repo in Claude Code or Cursor and the malware runs before you type anything. Here's why agent config is now code, and how to treat it that way.
-
· Paul Lukic
5 Claude Code Commands That Cut My Context-Switching in Half
The hidden Claude Code slash commands experienced terminal devs actually use daily — /statusline, !, @, /add-dir, /btw, /branch — what each saves, where /add-dir breaks at scale, and the Codex CLI gotcha that ruins muscle memory.
-
· Paul Lukic
Per-Session Audit Logs: Scoping the Blast Radius of an AI Coding Agent
A single rolling audit log of every shell command your AI coding agent ran is good. A per-session log is better. Here's why scope matters, what changed in Coograph this week, and how to roll the same pattern into your own setup.
-
· Paul Lukic
The TanStack npm Compromise: Why Every AI Coding Agent Needs an Audit Log
On 11 May 2026, 84 malicious versions of 42 @tanstack/* packages hit npm and started stealing AWS, GCP, Kubernetes, Vault, GitHub, and SSH credentials. If your AI coding agent ran npm install during that window, you may never know. Here's why agent command logging is now non-negotiable.