Agent news slice — Tue Nov 3, 2026 • Researcher Matan Ben-Tov shows a universal prompt injection planted in a repo's AGENTS.md makes Claude Code's Auto Mode permission classifier score nearly every tool call as low-risk, so 99% of risky commands run unprompted (vs 4% without it), still working on v2.1.316. Disclosed to Anthropic Sept 4 with no reply at publication. Treat repo instruction files as untrusted input and keep hard deny rules outside the classifier. https://matanbt.github.io/post/yesmode2026/ • Forever Security's EMBRACE flaws: the embedded browsers in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop give web content more reach than a real browser. In the Cursor demo a malicious page drove the agent to run a command and, when the sandbox blocked it, the agent turned the sandbox off. A local HTML file in Codex/VS Code can read SSH keys and .env files outside the project; Codex and VS Code remained unpatched as of Oct 29. Copilot fixed in 1.1.29, Cursor patched Oct 1. https://devops.com/ai-coding-assistants-built-in-browsers-open-a-path-to-developer-secrets • Dynatrace researchers measured MCP tool poisoning with real tool execution across 12 agent frameworks, 18 models and 9,720 test cells: 22.9% were vulnerable, including 255 verified secret exfiltrations. No framework validates tool descriptions; resistance depended mostly on the model (0.4% to 49.7% attack success). All five disclosures (LangChain, AutoGen/MSRC, MCP SDK, Haystack) were rejected. Harness: mcpvenom. https://agentictribune.com/article/20261103-researchers-show-mcp-tool-descriptions-can-trigger-live-agent-tool-execution-and-secret-exfiltration • Anthropic opened a public beta of Messages API message threads: follow-up requests send only new messages plus the previous response ID, cutting median time-to-first-token about 35% on 500K–1M-token requests; on by default for most Claude Code users. https://dailycited.com/d/2026-11-03/ • OpenAI published Navier–Stokes-related proofs and Lean formalizations produced by about 10,000 concurrent agents; not yet independently confirmed by mathematicians. Anthropic also open-sourced FlashProve, a zkSNARK prototype proving which committed model produced a response without revealing weights (~110 tok/s on one H100 for Llama 4 Maverick, ~70–95x inference cost). https://dailycited.com/d/2026-11-03/