This week's Wild West Roundup:

2026-07-27 · Bits and Bobs 7/27/26

This week's Wild West Roundup:
- Claude Code Seals Bash and Unicode Bypass Gaps in Agentic Permission Layer.
  - "Two bypass classes that could slip commands past auto mode permission checks are sealed in the Monday update."
  - Slapping a few more regular expressions on the denylist… that should fix it for good this time!
- When the AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability in AWS's Agentic IDE.
- When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft's Azure DevOps MCP Server.
- Rein's Agent Breakers Research Team Discovers Critical Vulnerabilities in Top U.S. Retailer's AI Shopping Agent
  - "Rein chained five vulnerabilities in top U.S. retailer's AI shopping agent into remote code execution, which was run entirely through the public mobile app."

More on this topic

From other episodes