Serena's trust gate blocked the shell command and missed the template

A .serena/project.yml file is enough. Clone a repository, point your coding agent at it, and attacker-supplied code runs before the MCP server answers its first request from the model. GitLab’s Threat Research Group published the finding yesterday: a server-side template injection in Serena, tracked as GHSA-pp25-4cg4-qcr9 with a CVE pending, reaching arbitrary code execution through a Jinja2 environment that was never sandboxed. The repository carries 27.8k GitHub stars, the serena-agent package pulls roughly 136,000 downloads a month on PyPI, and it plugs into Claude Code, Cursor, VS Code, JetBrains, and Claude Desktop. Anyone on 1.6.1 or earlier belongs on 1.7.0 today.

The bypass is the part that matters. Serena built a trust gate for exactly this threat: trusted_project_path_patterns decides which projects may use activation_command, the feature whose entire job is running a shell command when a project opens. GitLab ran their end-to-end test with that pattern list empty, stricter than any shipped default, and watched activation_command get blocked as designed while the template injection executed anyway. The added_modes field in project.yml accepts anything that looks like a path, the mode loader reads that file’s prompt string, and create_system_prompt() passes it to JinjaTemplate().render() without ever consulting is_trusted(). yaml.safe_load was used correctly and made no difference, because the payload is a plain string that only becomes code one call later. GitLab reported it August 1 and the maintainers shipped the fix eight days after. Their framing is the durable lesson: a CI pipeline runs with scoped credentials in an isolated box, while an MCP server runs in the developer’s own user context with reach over SSH keys, cloud credentials, .env files, and internal network resources. They put the MCP ecosystem roughly where npm sat a decade ago, adoption outrunning scrutiny, and they expect more findings in this shape.

Yesterday also took GitHub down. Error rates hit roughly 20% across the web interface and API starting around 9:40 a.m. EDT Monday, with raw content and archive downloads near 50% and SAML, OIDC, SCIM, and Team Sync broadly impaired, per DevOps.com’s account. Copilot and Actions degraded alongside. Recovery signs appeared by 12:36 p.m. EDT, and a post-incident review is still pending. Monday morning is when teams open sprints and drain backlogs, so the blast radius was about as wide as it gets, and several users noted that small performance hitches have been showing up more often in recent weeks.

Cursor picked that window to ship a GitHub competitor. Origin, its code hosting platform, went into public beta the same afternoon, with repo sync from GitHub and integrations already live for Vercel, Buildkite, and Depot. Gergely Orosz said out loud what everyone was thinking, that a stable GitHub makes alternatives far less interesting, and swyx amplified the launch within hours. Whether Origin is good is a question for next month; that a serious agent vendor now wants to own the repository, not just the editor, is the structural news.

Two announcements landed on the security side of agent design, and they read as a pair with the Serena disclosure. Google’s zero-trust guide for the Agent Development Kit argues that agents mutating production state need hardware-backed cryptographic signatures on database writes, gVisor kernel sandboxing for dynamically generated code, and deterministic semantic gateways validating I/O, rather than system-prompt instructions asking the model to behave. Same day, same conclusion from two directions: the boundary has to sit in infrastructure, because a prompt is not a control.

On availability, Amazon Bedrock added the OpenAI GPT-5.6 family (Sol, Terra, and Luna) to the bedrock-runtime endpoint across the Responses, Converse, and Chat Completions APIs, plus Global and Geo cross-Region inference for higher throughput and lower cost. If you were routing around Bedrock to reach those models directly, that detour is now optional.

Nathan Lambert used the day to argue about who pays for open weights. In Teaching Everyone to Fish for Tokens he puts Nvidia’s spend on near-open models at a reported $26 billion and reads it as demand generation: the more organizations that can train and serve their own models, the more inference gets bought, and the less intelligence concentrates in two API vendors. He sets that against Meta’s approach with Muse Spark 1.2, which he describes as flooding the zone with tokens to slow the revenue growth of companies that sell them. His pessimistic branch is the interesting one. As base-model training gets absorbed into an opaque reasoning-training stage, fewer builders release true base models, the open recipe drifts toward efficiency and specialization, and open weights settle into on-prem enterprise agents rather than frontier work.

Token economics is also where the loudest practitioner complaint of the day sat. An r/ClaudeCode post did the arithmetic on weekly limits: until July 19 a maxed-out five-hour session consumed 7.5% of the weekly budget, and since then it has consumed 10%, which is exactly the pre-summer-sale rate. Multiple adjacent threads reported single Opus 5 prompts at high thinking effort burning an entire five-hour window without editing a file. Anecdotes, but consistent ones, and they land on the same surface Lambert is describing from the supply side.

Smaller, and worth a look if you run agents all day: Amp now lets you talk to Puck over realtime voice, which is a different interaction shape than the terminal-and-diff loop most harnesses assume. And the EU AI Act’s Article 50 took effect August 2, requiring machine-detectable marking of synthetic output; InfoQ reports that major providers have moved to statistical watermarking that biases generation without measurable quality cost. Text watermarking survives paraphrase poorly, so the compliance-versus-detection gap is the thing to track, not the announcement.

Watch two things over the next few days. GitHub’s post-incident review, which will say whether Monday was a one-off or capacity strain from AI-driven traffic, and whether the Serena disclosure is followed by others in the same shape. GitLab said plainly that they expect more, and the added_modes pattern (project config reaching a template engine or a subprocess without a trust check) is not exotic enough to be rare.