SDLC with Agents — Week 45, 2026
Harnesses carry more than you think: hidden instruction stacks, poisoned memory files, a backdoored extension, an email in the prompt.
This week
Hidden in Plain Sight: an Empirical Study about The Instruction Stacks of Coding Agents
arXiv · 2026-10-27
Best item this week. Five harnesses, 1,886 releases, the first model request captured each time. Your prompt is a small part of what the model reads, and the rest changes under you with every update. The method matters most: intercept the request and diff it.
Security Impact of Coding Agent’s Memory Files
arXiv · 2026-10-28
Worth reading. A memory file is loaded as trusted guidance, and a pull request can change it. The study asks whether a poisoned file yields code that passes tests yet is vulnerable. Law 4: if one file steers both code and tests, passing tests are not an independent check.
Claude Code regularly sends each background agent’s transcript to its model
Hacker News · 2026-10-29
Plausible and important, but unverified: one gist, and no snippet we can check. If background agent transcripts are resent to the model, that is context the user never chose. Law 2: those tokens cost money and attention. Who reads them, and for what?
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Hacker News · 2026-10-30
Real and serious. A coding-agent extension runs with the developer’s shell, files and credentials, so a compromised marketplace build means a compromised machine. Cursor posted a security notice. Treat agent extensions as dependencies: pin versions, check the publisher, review updates.
Claude Code 2.1.314
Claude Code changelog · 2026-10-30
Two lines matter, the rest is admin. blockWritesOutsideWorkingDirectories puts a path boundary in the write tools in every permission mode. Idle compaction summarizes a 200K+ idle conversation once the cache expires. Law 1: the session you resume is a summary the harness wrote.
Tell HN: Claude Code adds your email to the prompt, the LLM sends it to websites
Hacker News · 2026-10-29
Small but telling. A GitHub issue says the harness puts the user’s email in the prompt; a Reddit post says the model then sent it to a website. Two anecdotes, not a measurement. The lesson holds anyway: anything in context can leave through any networked tool.
Deep-dive candidate
Hidden in Plain Sight: an Empirical Study about The Instruction Stacks of Coding Agents — Capturing and diffing the first model request across harness versions is an experiment any reader can reproduce with a proxy, and it shows what the model actually sees.
Rejected (and why)
- Claude Code VS Code extension with backdoor released on Cursor marketplace — dropped at draft: Duplicate of k5, and its headline that Anthropic was hacked goes beyond what we can verify.
- How Do Coding-Agent Harnesses Self-Evolve? An Empirical Study of Retrospective Adaptation — Solid measured study, cut only by the arXiv cap; 30 SWE-bench issues is small. Strong candidate next week.
- The Physical Cost of Context: Quality-Constrained Resource Accounting for Coding Agents — Good cost mechanism: rewriting cached history can make shorter prompts dearer. Cut by the arXiv cap, not on merit.
- “Shall We Approve?” Consequence-Aware Approval for Autonomous Coding Agents — Approvers that judge consequences, not command text, is a real idea. Lost to the arXiv cap this week.
- Spine: Compiling Subtask Trees into Structured Context for Long-Horizon Coding Agents — Structured subtask context is a plausible fix for context inflation, but less evidence in the snippet than kept papers.