TerminalBlogIndependent coverage of the AI coding agent ecosystem — security bugs, real adoption data, comparisons, and what actually ships. Claude Code, Cursor, Hermes, Codex, OpenCode, and more.2026-09-14T00:00:00.000Zhttps://terminalblog.com/Anshadhttps://terminalblog.com/favicon.svghttps://terminalblog.com/blog/coding-agent-weekly-2026-09-14/<![CDATA[Coding Agent Weekly — 2026-09-14]]>2026-09-14T00:00:00.000Z2026-09-14T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-claude-code-rmdir-bypass-mass-deletion/<![CDATA[Beware: Claude Code Routed Around a Delete-Protection Block With cmd rmdir — a Quoting Bug Then Destroyed ~10,000 Files (No Fix)]]>2026-09-12T09:30:00.000Z2026-09-12T09:30:00.000ZAnshadhttps://terminalblog.com/blog/claude-code-plugin-eval-prove-your-plugins-work/<![CDATA[Claude Code Just Let You Prove Your Plugins Actually Work — No More Guessing]]>2026-09-12T08:30:00.000Z2026-09-12T08:30:00.000ZAnshadhttps://terminalblog.com/blog/rtk-token-savings-hn-developers/<![CDATA[What Developers Actually Think About RTK Token Savings — From 80 HN Comments]]>2026-09-12T00:00:00.000Z2026-09-12T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-cline-web-fetch-ssrf-iam-credentials/<![CDATA[Beware: Cline's web-fetch Tool Will Fetch Localhost and Cloud Metadata — IAM Credentials Handed to the Model (SSRF, Unpatched)]]>2026-09-11T06:15:00.000Z2026-09-11T06:15:00.000ZAnshadhttps://terminalblog.com/blog/claude-opus-5-verbosity-hn-developer-backlash/<![CDATA[Developers Are So Done With Claude's Word Salad That They Built a Viral 30k-Star Workaround]]>2026-09-11T00:00:00.000Z2026-09-11T00:00:00.000ZAnshadhttps://terminalblog.com/blog/codex-0-154-gpt6-astra-worktrees-windows-daemon/<![CDATA[Codex Just Made GPT-6 Astra Its Default — and Nobody Is Talking About It]]>2026-09-10T14:00:00.000Z2026-09-10T14:00:00.000ZAnshadhttps://terminalblog.com/blog/claude-code-effort-cap-fable-5-1-cost-control/<![CDATA[Claude Code Finally Lets You Cap AI Effort — And Stop Wasting Money]]>2026-09-10T10:00:00.000Z2026-09-12T05:00:00.000ZAnshadhttps://terminalblog.com/blog/goose-v1-50-gpt6-astra-web-search-security-wave/<![CDATA[Goose Just Got GPT-6 Astra and Web Search Built In — the September Wave Is Huge]]>2026-09-10T09:00:00.000Z2026-09-10T09:00:00.000ZAnshadhttps://terminalblog.com/blog/hn-coding-agent-culture-war-september-2026/<![CDATA[The Coding Agent Culture War: What 140+ HN Comments Reveal About the Workplace Divide]]>2026-09-10T00:00:00.000Z2026-09-10T00:00:00.000ZAnshadhttps://terminalblog.com/blog/qwen-code-v0-23-1-goals-pause-stuck-worktree-tasks/<![CDATA[Qwen Code Finally Knows When to Give Up — Now It Calls Claude Code for Help]]>2026-09-08T19:15:00.000Z2026-09-11T09:00:00.000ZAnshadhttps://terminalblog.com/blog/coding-agent-weekly-2026-09-07/<![CDATA[Coding Agent Weekly — 2026-09-07]]>2026-09-07T00:00:00.000Z2026-09-07T00:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-v0-21-pantheon-bots-that-talk-to-each-other/<![CDATA[Hermes Agent v0.21 Just Made Your Bots Talk to Each Other — Here's What Changed]]>2026-09-01T09:45:00.000Z2026-09-01T09:45:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-ai-code-review-validity-hn/<![CDATA[What Developers Think About AI Code Review — The Validity Crisis From HN Threads]]>2026-09-01T00:00:00.000Z2026-09-01T00:00:00.000ZAnshadhttps://terminalblog.com/blog/coding-agent-weekly-2026-08-31/<![CDATA[Coding Agent Weekly — 2026-08-31]]>2026-08-31T00:00:00.000Z2026-08-31T00:00:00.000ZAnshadhttps://terminalblog.com/blog/ai-agents-atrophying-developer-brains-hn-threads/<![CDATA[AI Coding Agents Are Atrophying Developer Brains — What 200+ HN Comments Reveal]]>2026-08-28T00:00:00.000Z2026-08-28T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-claude-code-security-guidance-leaks-oauth-tokens/<![CDATA[Beware: Claude Code's Security-Guidance Plugin Leaks Your OAuth Tokens Into the Transcript]]>2026-08-28T00:00:00.000Z2026-08-28T00:00:00.000ZAnshadhttps://terminalblog.com/blog/cursor-3-glass-agents-window-review/<![CDATA[Cursor 3 Just Replaced Your Code Editor With an Agent Command Center — Here's the Honest Truth]]>2026-08-28T00:00:00.000Z2026-08-28T00:00:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-ai-coding-agents-hn-discussion/<![CDATA[What Developers Really Think About AI Coding Agents — Raw Truth From 200+ HN Comments]]>2026-08-28T00:00:00.000Z2026-08-28T00:00:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-ai-coding-expertise-collapse-hn/<![CDATA[What Developers Actually Think About AI Coding Expertise Collapse — From 500+ HN Comments]]>2026-08-25T00:00:00.000Z2026-08-25T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-cline-kanban-websocket-rce/<![CDATA[Beware: Cline Kanban WebSocket Hijack Lets Any Website Steal Your Code & Run Commands (CVE-2026-44211)]]>2026-08-24T00:00:00.000Z2026-08-24T00:00:00.000ZAnshadhttps://terminalblog.com/blog/block-berd-open-source-agent-desktop-unifies-claude-codex-goose/<![CDATA[Block Just Open-Sourced Their Internal AI Command Center — And It Unifies Every Coding Agent]]>2026-08-24T00:00:00.000Z2026-08-24T00:00:00.000ZAnshadhttps://terminalblog.com/blog/coding-agent-weekly-2026-08-24/<![CDATA[Coding Agent Weekly — 2026-08-24]]>2026-08-24T00:00:00.000Z2026-08-24T00:00:00.000ZAnshadhttps://terminalblog.com/blog/openai-gpt-5-6-pricing-crash-changes-agent-economics/<![CDATA[OpenAI Just Slashed GPT-5.6 Prices 80% — Coding Agents Got Way Cheaper]]>2026-08-23T10:00:00.000Z2026-08-23T10:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-allowlist-bug-security-boundaries/<![CDATA[Hermes Agent's Allowlist Bug: When Security Boundaries Disagree]]>2026-08-23T00:00:00.000Z2026-08-23T00:00:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-codex-vs-claude-hn-2026/<![CDATA[What Developers Actually Think About Codex vs Claude — From 221 HN Comments]]>2026-08-23T00:00:00.000Z2026-08-23T00:00:00.000ZAnshadhttps://terminalblog.com/blog/cursor-spacex-acquisition-ai-coding-agent-war/<![CDATA[Cursor Just Got Acquired by SpaceX — The AI Coding Agent War Entered a New Era]]>2026-08-22T00:00:00.000Z2026-08-22T00:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-zip-update-silent-data-loss/<![CDATA[Hermes Agent's ZIP Update Fallback Silently Destroys Your Local Patches — Windows Users, Check Your Repo]]>2026-08-22T00:00:00.000Z2026-08-22T00:00:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-ai-agents-hn-200-comments/<![CDATA[What Developers Actually Think About AI Coding Agents — From 200+ HN Comments]]>2026-08-22T00:00:00.000Z2026-08-22T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-opencode-context-integrity-pruning-injection/<![CDATA[Beware: OpenCode's Context Management Silently Deletes Your Constraints and Injects Unauthorized Actions]]>2026-08-21T14:00:00.000Z2026-08-21T14:00:00.000ZAnshadhttps://terminalblog.com/blog/google-antigravity-killed-gemini-cli-terminal-ai-war/<![CDATA[Google Just Killed Gemini CLI — Antigravity 2.0 Is the New Terminal King]]>2026-08-20T00:00:00.000Z2026-09-10T00:00:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-coding-agents-hn/<![CDATA[Anthropic's Lock-In Play and Opus 5's 'Agent Speak' — What 300+ HN Developers Revealed This Week]]>2026-08-20T00:00:00.000Z2026-08-20T00:00:00.000ZAnshadhttps://terminalblog.com/blog/claude-code-v2-1-235-spellcheck-performance-fixes/<![CDATA[Claude Code Just Got Spellcheck — And Fixed 15 Things You've Been Complaining About]]>2026-08-19T00:00:00.000Z2026-08-19T00:00:00.000ZAnshadhttps://terminalblog.com/blog/jetbrains-ai-coding-agent-adoption-survey-2026/<![CDATA[The AI Coding Agent Race Just Flipped — Claude Code Is Now Twice as Popular as Copilot]]>2026-08-19T00:00:00.000Z2026-08-19T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-agentjacking-sentry-mcp-hijacks-claude-code-cursor-codex/<![CDATA[Agentjacking: Fake Sentry Bug Hijacks 100+ AI Coding Agents]]>2026-08-18T00:00:00.000Z2026-08-18T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-cursor-duneslide-rce-cve-2026-50548-50549/<![CDATA[Beware: Cursor DuneSlide — Two Critical RCE Vulnerabilities (CVE-2026-50548, CVE-2026-50549) Let Attackers Escape the Sandbox via Zero-Click Prompt Injection]]>2026-08-18T00:00:00.000Z2026-08-18T00:00:00.000ZAnshadhttps://terminalblog.com/blog/claude-code-just-patched-credential-leak-cross-session-messaging/<![CDATA[Claude Code Just Patched Its Credential Leak — And Made Sessions Talk Across Machines]]>2026-08-18T00:00:00.000Z2026-08-18T00:00:00.000ZAnshadhttps://terminalblog.com/blog/claude-code-v2-1-234-ntlm-leak-fixed-50-fixes/<![CDATA[Claude Code Just Patched the NTLM Credential Leak — And 50 Other Fixes You'll Actually Feel]]>2026-08-18T00:00:00.000Z2026-08-18T00:00:00.000ZAnshadhttps://terminalblog.com/blog/cursor-origin-code-hosting-agents-every-repo/<![CDATA[Cursor Just Got Acquired by SpaceX — And Launched Origin, Its Agent-Native Code Host]]>2026-08-18T00:00:00.000Z2026-08-20T00:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-v0-20-4-patch-74-prs-glass-ui-bot-mode/<![CDATA[Hermes Agent Just Dropped v0.20.4 — 74 PRs in 48 Hours, Glass UI, and Bot Mode That Actually Works]]>2026-08-18T00:00:00.000Z2026-08-18T00:00:00.000ZAnshadhttps://terminalblog.com/blog/openhands-1-14-git-sync-free-kimi-breakthrough/<![CDATA[OpenHands Just Added the Git Sync Button Everyone Begged For — And Made Kimi K3 Free by Default]]>2026-08-18T00:00:00.000Z2026-09-10T00:00:00.000ZAnshadhttps://terminalblog.com/blog/what-developers-think-ai-coding-without-vibes-hn/<![CDATA[What Developers Think About AI Coding Without the Vibes — From 55 HN Comments]]>2026-08-18T00:00:00.000Z2026-08-18T00:00:00.000ZAnshadhttps://terminalblog.com/blog/zed-v1-16-pre-gemini-flash-git-panel-mermaid/<![CDATA[Zed Just Added Gemini 3.6 Flash — And Made Git Panel Actually Usable]]>2026-08-18T00:00:00.000Z2026-09-11T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-claude-code-trust-dialog-bypass-cve-2026-33068/<![CDATA[Claude Code Silently Skipped Your Security Prompt — Malicious Repos Could Disable It]]>2026-08-17T18:00:00.000Z2026-08-17T18:00:00.000ZAnshadhttps://terminalblog.com/blog/github-copilot-cli-1-0-80-ahp-shared-sessions/<![CDATA[GitHub Copilot CLI Just Made Shared Terminal Sessions Real — Here's Why It Changes Everything]]>2026-08-17T10:00:00.000Z2026-08-17T10:00:00.000ZAnshadhttps://terminalblog.com/blog/coding-agent-weekly-2026-08-17/<![CDATA[Coding Agent Weekly — 2026-08-17]]>2026-08-17T00:00:00.000Z2026-08-17T00:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-v0-20-2-patch-release-desktop-gateway-cli/<![CDATA[Hermes Agent v0.20.2 Just Landed — 397 Fixes in 3 Days, Desktop & Gateway Get Major Polish]]>2026-08-17T00:00:00.000Z2026-08-17T00:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-v0-20-3-patch-mcp2-bot-mode-commandcode/<![CDATA[Hermes Agent Just Dropped v0.20.3 — MCP 2.x, Bot Mode, and Self-Healing Cron in One Patch]]>2026-08-17T00:00:00.000Z2026-08-17T00:00:00.000ZAnshadhttps://terminalblog.com/blog/beware-cursor-cli-worktree-pre-trust-rce/<![CDATA[Beware: Cursor CLI Ran Your Attacker's Code Before You Clicked 'Trust' — Pre-Trust RCE in Worktree Setup]]>2026-08-16T12:00:00.000Z2026-08-16T12:00:00.000ZAnshadhttps://terminalblog.com/blog/hermes-agent-v0-20-1-patch-release-656-fixes/<![CDATA[Hermes Agent v0.20.1 Just Dropped — 656 Fixes, One Stable Release]]>2026-08-16T00:00:00.000Z2026-08-16T00:00:00.000ZAnshad