self.md radar — 2026-09-10
the file you ask an agent to read now has a job interview
Google is writing about prompt injection against coding agents. Calif Research says a WeChat call can carry a zero-click exploit. A new paper wants AI-scientist systems judged on the trail they leave, not only the answer they hand back.
1. Google puts coding agents in the prompt-injection file
Google Threat Intelligence says attackers are using prompt injection against coding agents . The instruction can sit in material the agent has been asked to read, then allowed to act around: a repository file, an issue, a document, whatever arrived with the work.
An agent with access to code, tickets and credentials needs a boundary between untrusted text and authority. Reading a file is no longer the harmless half of the job.
reading: Google Threat Intelligence’s report
2. Calif says the unanswered call is enough
Calif Research’s WeWorm disclosure describes a zero-click worm spread through WeChat calls on iOS and Android. The target does not need to answer or touch the phone; if they do answer, the call is silent and the exploit still succeeds. The researchers describe the result as remote code execution.
Treat the page as a research disclosure, not a count of infected phones. It still changes the immediate question for anyone running the app: a call handler can be attack surface even before a person decides to participate.
reading: WeWorm research page
3. An AI scientist may need to keep its lab notebook
OpenDiscoveryTrace , newly posted on arXiv, proposes process traces for evaluating AI-scientist workflows. A final result can look clean while the route to it was careless, contaminated, or simply impossible to audit.
This is not a finished evaluation standard. If an agent is allowed to research on someone’s behalf, its sources, branches and checks need to survive the handoff.
reading: OpenDiscoveryTrace on arXiv
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Sandboxing and security — give agents useful power without giving them the whole house