Armor1

Check the security posture of MCP servers in use and those under consideration. See for yourself at

[Armor1 @armor1_ai]

Although this doesn't happen often, without the proper guardrails you can lose all your data in a single session. Armor1 makes protecting your agent configs so easy you never have to think about it.

[Matt Shumer @mattshumer_]

GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files.

And this is why I trust Fable 1000x more.

[Armor1 @armor1_ai]

Check any MCP server's risk free: https://t.co/35DuICultW.

Full environment scan (apps, MCPs, skills, plugins): https://t.co/4ji302fRtD

[Armor1 @armor1_ai]

A new analysis of 200,000+ AI agent skill files found that ~15% of distinct skill files carry hardcoded credentials paired with direct database write access. That is not a CVE. That is a measurement of what is already running in developer environments.

[Armor1 @armor1_ai]

Two independent analyses, same week, same conclusion. One detail that should not get lost: malicious skills continue to propagate after campaigns are officially terminated. A takedown is not the same as remediation.

[Armor1 @armor1_ai]

Same week: security researchers documented a March 2026 campaign using deceptive community skills. The delivery mechanism: tampered installation instructions inside the skill file itself. The agent reads them as trusted guidance. Remcos RAT + GhostLoader in the payload.

[Armor1 @armor1_ai]

Capsule Security's number: 2,909 of 19,618 distinct skill files. Credentials + database write access + no additional exploit needed = data exfiltration on install. AI workload supply chain surface: 6x larger than traditional software.

[Armor1 @armor1_ai]

@AnthropicAI Check any MCP server's risk free: https://t.co/Tps9Kwuh0H. Full environment scan (apps, MCPs, skills, plugins): https://t.co/HQ58qhxtcZ.

[Armor1 @armor1_ai]

Claude Code CLI: code execution paths fired BEFORE the trust dialog. Patched quietly in Dec 2025; public technical write-up dropped April 30. @AnthropicAI

[Armor1 @armor1_ai]

@AnthropicAI This is the second pre-trust execution category to surface this week (the other: Cursor CVE-2026-26268 via Git hooks). Same structural shape, different mechanism.

[Armor1 @armor1_ai]

@AnthropicAI Action: ensure your Claude Code CLI is on a release dated after Dec 2025. Auto-update on by default. The structural question for every AI IDE: what runs before "trust this workspace"?

[Armor1 @armor1_ai]

@AnthropicAI Class: traditional security flaws (trusting workspace config files) that the LLM-era threat model didn't displace, just stacked on top of. Pre-LLM bugs still bite agentic CLIs.

[Armor1 @armor1_ai]

@AnthropicAI Mechanism: workspace-scoped config files, plugin/extension manifests, and project-local hooks parsed and executed during the bootstrap, before the user clicks "trust this workspace."

[Armor1 @armor1_ai]

@cursor_ai Check any MCP server's risk free: https://t.co/2GplhiG6bY. Full environment scan (apps, MCPs, skills, plugins): https://t.co/uEmTgJgeHF.

[Armor1 @armor1_ai]

CVE-2026-26268: Cursor RCE via hidden Git hooks. CVSS 8.1. Opening a prepared repo runs code in your session before any prompt injection or user click. Fixed in Cursor 2.5. @cursor_ai

[Armor1 @armor1_ai]

@cursor_ai Update to Cursor 2.5. Then audit which AI IDEs your fleet runs and what each agent does autonomously on a fresh workspace.

[Armor1 @armor1_ai]

@cursor_ai Pattern: features that grant the agent autonomy collide with features that gate untrusted code. Git, package install, editor config, language servers, all candidates. Cursor is the visible one this week.

[Armor1 @armor1_ai]

@cursor_ai Blast radius: session tokens, API keys, env vars, anything the dev's process can reach. Agent autonomy + workspace-controlled hook scripts = pre-trust execution path.

[Armor1 @armor1_ai]

@cursor_ai Mechanism: agent performs normal Git ops on a new workspace. Repo ships a .git/hooks/ config. Hook runs in dev's session with full privileges. No prompt injection needed. Just open the repo.

[Armor1 @armor1_ai]

@AnthropicAI Check any MCP server's risk free: https://t.co/TBPoQEt4wZ. Full environment scan (apps, MCPs, skills, plugins): https://t.co/Ro8Mm4IStf

[Armor1 @armor1_ai]

CVE-2026-39861: Claude Code sandbox escape via symlink following. CVSS v4 7.7. Sixth Claude Code advisory this review period. Fixed in 2.1.64. @AnthropicAI

[Armor1 @armor1_ai]

@AnthropicAI Six advisories, six attack classes: argument injection, domain bypass, credential theft, command injection, hook injection, now symlink escape. Multiple independent researchers. Update to 2.1.64 or confirm auto-update is on.