This week's developments
Coding-assistant session hijacked, worm spreads across ~100 repos. Mandiant reported that an attacker hijacked an AI coding-assistant session and used it to spread the Shai-Hulud worm across roughly 100 internal code repositories at a SaaS provider. It's one of the clearest signals yet that agentic coding tools are becoming a live supply-chain attack vector rather than a theoretical risk — a hijacked, developer-trusted agent session becomes a ready-made lateral-movement tool. (Source: The Hacker News)
Temporal raises $550M at a $12.55B valuation. Temporal, the durable-execution orchestration platform increasingly used to keep long-running AI agent workflows reliable, closed a $550M Series E. The jump signals investors betting heavily on the reliability "plumbing" underneath agents, not just the agents themselves. (Source: Temporal)
Coding-agent startup Factory triples valuation to $5B in five months. Factory, maker of AI coding agents ("Droids"), raised $200M, tripling its valuation in under half a year. Paired with Temporal's raise, it's a reminder that capital is flowing to both the agents doing the work and the infrastructure keeping them reliable. (Source: DevOps.com)
Exaforce launches an AI agent "kill switch." Exaforce expanded its AI Security platform with runtime visibility and containment controls for AI agents and applications, from endpoint to cloud, including a kill-switch capability. It reads as a direct response to incidents like the Mandiant one above — as agents get more autonomy, security vendors are racing to ship the equivalent of an emergency stop. (Source: Business Wire)
Read across
Security incidents and capital kept arriving in the same week. This is the first sourced case we've tracked of an AI coding session being hijacked as an active worm-propagation vector rather than a hypothetical one, and it landed the same week enterprise security vendors shipped kill switches and durable-execution infrastructure pulled in a $550M round. The pattern worth watching for enterprises: the tooling that makes agents useful — session persistence, repo access, autonomy — is the same tooling that makes them exploitable, and the market is now pricing both sides of that trade-off at once.
For background on how agentic automation differs from the RPA it's replacing, browse our archive: https://buttondown.com/TheAutonomousEdge/archive
If this was useful, forwarding it to one colleague who'd care is the best way to help it grow.
Subscribe at https://buttondown.com/TheAutonomousEdge
Next issue: Monday, September 28, 2026.
Top comments (2)
The Shai-Hulud incident highlights that AI coding agents can inherit the same broad access as developers, including repositories and CI/CD configurations. A critical control is auditing whether the agent’s write permissions actually match its assigned task before those permissions become an attack path.
This is terrifying. The Shai-Hulud worm spreading through a hijacked coding session is basically the nightmare scenario for anyone giving agents repo access. If the agent inherits the developer's permissions, it becomes a perfect supply chain attack vector.
I'm 12, I don't own a laptop, and I build everything on a $150 Android phone using Termux. Because I can't afford enterprise security platforms, I've had to build my own containment layers, and this article hits close to home.
For the session hijack problem, I built KAVLR. It's a fail-closed CLI that intercepts terminal commands before the OS executes them. It checks a Postgres policy engine for known bad binaries, and if the command is unknown, it sends it to a Constitutional AI (Llama 3 via Groq) to grade the semantic intent. If the score is below 90, it fails closed. The craziest test was when I tried to run
rm -fto uninstall my own CLI during debugging. The AI intercepted it, recognized the destructive filesystem action, and blocked its own deletion. I accidentally built a leash that developed self-preservation.For the lateral movement across 100 repos, I built HYNA-Stage. Instead of trying to perfectly validate every action inside a persistent environment, I made the environment disposable. It spins up Firecracker MicroVMs in about 5 seconds. If an agent gets infected or goes rogue, the TTL hits zero and the whole machine just evaporates. No persistence, no lateral movement, no blast radius.
You mentioned Exaforce launching a kill switch. Do you think a centralized kill switch is fast enough when the worm is already propagating through internal CI/CD pipelines, or does the industry need to shift to disposable/ephemeral execution environments by default?