Security researchers showed that four popular AI coding agents can be made to break out of their sandboxes without directly attacking the sandbox boundary. The issue is not that the agents leave the workspace on their own, but that they can write files that trusted local tools later execute, load, or scan on the host system.

JadePuffer, an autonomous AI-driven attacker, has evolved from general ransomware behavior to a custom payload called EncForge that is designed to encrypt AI and machine learning assets. The malware targets model checkpoints, vector databases, training datasets, and embedding indexes rather than ordinary business files. That shift makes the attack especially damaging because it aims at the artifacts needed to run and retrain AI systems.

Malicious GitHub activity dubbed FakeGit has spread across nearly 7,600 repositories, with more than 800 impersonating AI skills or Model Context Protocol (MCP) servers. The campaign uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to lure victims into downloading SmartLoader. SmartLoader then establishes persistence and can deploy StealC to steal credentials, sessions, and other sensitive data.