RSS Feeds

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

Hi readers, it’s me again! Caitlin will be back on Wednesday. Now, for today’s news: President Donald Trump, South Korea, and the state of the US’s military alliances.

Remember Trump’s first-term “love letters” with North Korean dictator Kim Jong Un? Trump was so fond of them that he took them with him when he left the presidency in 2021 (the National Archives did not approve). Now, it seems like the two leaders are taking up where they left off.

Over the weekend, Trump announced in a social media post that he would “substantially reduce” scheduled joint military exercises between the US and South Korea, which get underway today. The reason? His “very good relationship with Kim Jong Un, of North Korea.” 

But there may have been another reason. Trump also wrote that “While somewhat unrelated (?), I recently asked the President of South Korea if they would like to join us in the Denuclearization of the Islamic Republic of Iran, and they said, “No thanks!””

The US-South Korea exercises “are not only costly, with much of these costs paid for by the United States of America (as usual!),” Trump wrote, “but send a signal that is totally inappropriate and hostile, to a Country that, as long as Donald J. Trump has been President, has been unthreatening and respectful.”

That last part — “unthreatening and respectful” — is not exactly true; in 2017, Kim called Trump “a mentally deranged US dotard” whom North Korea would “tame…with fire.” But in the present day, Trump’s announcement is a boon to the North Korean leader, who has denounced the military exercises. 

It’s also just the latest incident in the historically close US-South Korea relationship (the two countries have held military exercises annually for more than 70 years). Earlier this year, Trump lashed out with new tariffs, accusing South Korea of “not living up to its Deal,” referring to a 2025 agreement on trade and security between the two countries that South Korea’s legislature had not yet approved.

Go a little deeper

The US has more permanent troops in South Korea than it does almost anywhere else in the world, behind only its deployments in Japan and Germany. Under Trump, though, those once-durable commitments have started to look a lot shakier.

Europe — and Germany in particular — has borne the brunt of Trump’s second-term harassment: In May, Trump announced his intent to remove 5,000 US troops from Germany and threatened to go “a lot further”; the Pentagon has said that withdrawal will take place within 12 months. The US currently has more than 38,000 troops stationed in Germany.

Trump has made similar threats about US troops stationed in Italy and Spain, and even suggested removing all US troops from Europe.

Most of these threats have been triggered by Trump’s unhappiness with European defense spending, which he’s eternally trying to boost. 

But in his second term, the threats have grown much more tightly tied to Trump’s personal ambitions and grievances. Trump’s Germany announcement followed a clash with German Chancellor Friedrich Merz over the US war with Iran, which Trump has tried — unsuccessfully — to drag US allies into. Spain, in particular, has also drawn Trump’s ire for vocally opposing the war. 

Last month, he also tied the US troop presence in Europe to his insistence that the US be allowed to take over Greenland, which belongs to Denmark, a US ally and founding NATO member.

One link for later

➨ A low-tech way to save coral reefs. My colleague Benji Jones visited the island nation of Palau, in the western Pacific Ocean, to learn about a new approach to reef restoration. Scientists there are testing species of coral specifically for heat resistance to find better options for replanting reefs — all using some plastic picnic coolers and a bit of hot water. 

Before you go…

• Did you know…that the Vera C. Rubin Observatory in the Chilean Andes has the largest digital camera ever made? It captured its “first light” last year in staggering high-definition. 
• Today’s trivia: What was the title of Iran’s ruler until 1979? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in tomorrow’s edition.)
• Friday’s trivia: On Friday, we asked you which US president responded to inflation by ordering wage and price freezes. That was President Richard Nixon.

Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9, CVE pending) that executes arbitrary code in the Serena process. Anyone on serena-agent 1.6.1 or earlier should update to 1.7.0 now.

A threat actor can exploit this by hiding a malicious .serena/project.yml file into a repository it controls and getting a developer to open it via the Serena Model Context Protocol (MCP) server. The flaw bypasses trusted_project_path_patterns, the control Serena built specifically to stop untrusted repositories from running code. We reported it privately on August 1, 2026, and the maintainers shipped a fix eight days later.

It is an early example of a risk class that will spread as MCP servers become embedded in the software development lifecycle.

Why MCP servers are a different kind of attack surface

Most developer tools touch a codebase in a narrow way: A linter reads files, a formatter writes them, and a test runner executes a specific harness. Conversely, MCP servers hand a large language model (LLM) a general-purpose interface to the developer's environment, covering file system access, shell execution, language server queries, and sometimes the network. The same reach that makes them useful makes compromising the server process severe.

CI/CD pipelines run in isolated environments with scoped credentials. MCP servers run on the developer's own machine, in the developer's own user context, with access to everything the developer can reach: SSH keys, cloud provider credentials, .env files, browser sessions, and internal network resources. Compromise the server process and you compromise the developer's entire local environment.

Developers point these servers at repositories they did not write all the time: evaluating a new open-source library, triaging a bug report, or reviewing a contributor's branch. If the server processes anything from that repository before the developer inspects it, the attacker gets a window. Serena is explicit about this threat and ships a trust model to prevent untrusted repositories from executing code. The trust model had a gap.

How the vulnerability works

What Serena is

Serena describes itself as "the IDE for your agent." It connects Claude, Cursor, Copilot, and other AI assistants to a local codebase over MCP, providing semantic code navigation, refactoring, and editing tools that go beyond what a raw file system gives an LLM. Developers run it as a local MCP server and point their assistant at it:

serena start-mcp-server --project /path/to/repo

Because Serena operates on arbitrary local repositories with the user's full OS privileges, it ships a trust gate. trusted_project_path_patterns controls which project paths count as trusted, and only trusted projects can use privileged features like activation_command, which runs a shell command on project open. The intended guarantee: opening an untrusted repository is safe.

The sink: An unsandboxed template engine

Serena lets each project define custom modes, named configurations with a prompt field that gets injected into the LLM's system prompt when the project is active. Serena renders these prompts as Jinja2 templates, and the rendering is the problem. In src/interprompt/jinja_template.py:

# line 22
self._env = jinja2.Environment()

jinja2.Environment() is a plain, unsandboxed environment. It exposes built-in globals whose attributes chain up through Python's object graph to os and subprocess. The techniques for reaching arbitrary code execution from that starting point are well documented and require no specialized knowledge. Jinja2 ships a SandboxedEnvironment for exactly this reason, but it was not used here.

The delivery: Project configuration as untrusted input

A project's .serena/project.yml supports an added_modes field, listing additional modes to activate when the project opens. Serena's mode loader treats any name containing a path separator or ending in .yml as a filesystem path to load directly:

# context_mode.py, lines 29-30
def looks_like_yaml_path(s: str) -> bool:
    return os.sep in s or (os.altsep and os.altsep in s) or s.lower().endswith((".yml", ".yaml"))

# context_mode.py, lines 130-135
@classmethod
def load(cls, name_or_path: str | Path) -> Self:
    if isinstance(name_or_path, Path) or looks_like_yaml_path(str(name_or_path)):
        return cls.from_yaml(name_or_path)
    ...

A path-like entry in added_modes causes Serena to load that file from the repository, read its prompt field verbatim, and pass it to the unsandboxed renderer. yaml.safe_load is used correctly and blocks YAML deserialization gadgets, but it has no bearing on a plain string inside the prompt field. The YAML parser sees harmless text. The injection happens later, when that string is compiled as a Jinja2 template.

The trust control bypass

is_trusted(), Serena's mechanism for preventing untrusted projects from executing code, gates two features: activation_command, the shell command run on project open, and ls_specific_settings, project-scoped tool overrides. The mode-loading and prompt-rendering path is never checked against is_trusted(). The added_modes list from a project's .serena/project.yml is processed without validation, and the mode loader applies no allowlist and no trust check before it loads the file and hands the prompt field to the template engine.

We confirmed the bypass empirically. We ran the same end-to-end test with trusted_project_path_patterns set to empty, so no project counts as trusted, stricter than any default configuration. Two things happened:

The feature whose entire purpose is to run a shell command is blocked. The template injection reaches the same outcome through a different path and runs freely. That makes it a protection mechanism failure (CWE-693). The trust model exists to prevent an untrusted repository from executing code, and this path defeats it while looking like ordinary project loading.

The full call chain

.serena/project.yml  (attacker-controlled, ships with the repo)
  added_modes: ["./path/to/attacker-mode.yml"]
        |
        v
SerenaAgentMode.load()            context_mode.py:130-135
  from_yaml(name_or_path)
  prompt = <attacker-controlled string>
        |
        v
SerenaAgent._update_active_modes()    agent.py:1063
        |
        v
create_system_prompt()                agent.py:996
  _format_prompt(mode.prompt)
  JinjaTemplate(prompt).render()      arbitrary code execution

Code runs as a side effect of the ordinary project-open flow, before Serena serves its first request to the LLM.

Exposure

Serena's reach in the developer ecosystem is substantial. The repository has 27.8k GitHub stars and 1.8k forks, and the serena-agent package records roughly 136,000 downloads per month on PyPI. It integrates with Claude Code, Cursor, VS Code, JetBrains IDEs, Claude Desktop, and OpenWebUI, covering the range of AI-assisted development environments in common use.

A realistic attack needs no infrastructure and no social engineering beyond the repository. An attacker publishes a library, a sample project, a CTF challenge, or a seemingly useful tool. A developer clones it, opens it with Serena, and the code runs. Given everything a developer's machine can reach, the payoff for the attacker is immediate. In a CI/CD setup where Serena processes submitted repositories automatically, no human interaction is required at all.

Why new tools inherit old bugs

None of the patterns behind this bug are unique to Serena.

User-supplied data flowed into a template engine without sandboxing. Template injection is one of the oldest vulnerability classes in web security, and most template engines ship a sandbox or restricted mode to address it. In a young ecosystem, developers building configuration-driven templating features often reach for the plain variant by default. The pattern will show up in other MCP tools.

Project configuration files were treated as trusted input. A repository's configuration files are authored by the repository owner. In any threat model where the repository may be untrusted, those files are attacker-controlled input. The distinction is easy to overlook when you build a tool and the configuration files feel like part of the tool itself.

Trust gates covered some code paths but not others. Serena's trust model was designed correctly: The gate exists, it is implemented, and the features it covers are clearly identified. The gap was a code path added without being brought under the same gate. Keeping trust coverage complete as a codebase evolves takes deliberate review of every new path that processes project-supplied input, not only the paths that are obviously privileged.

What this means for you

If you use Serena

Update to serena-agent 1.7.0 now. The fix switches the template engine to jinja2.sandbox.SandboxedEnvironment, which closes the injection path. On Versions 1.6.1 and earlier, avoid opening repositories from untrusted sources.

If you build MCP servers or AI coding tools

These practices should apply to any tool that reads a project directory for an LLM.

• Treat project configuration files as input from a possibly hostile repository owner. Validate them like an HTTP request body: check the structure and reject anything off-schema.
• Map every place a string becomes code or a command: template rendering, subprocess calls, plugin loading, dynamic imports. For each, know whether project input can reach it and what stops it.
• Make your trust gate cover every path, not one feature. Review it whenever you add a feature that reads project input.
• Test against a hostile repository before you ship. Build the most aggressive config you can, confirm nothing runs on open, and automate it.

If you lead a security team

MCP servers are a new class of local attack surface running with your developers' full user context, so treat them like any other privileged tooling on those machines. Start by finding out which MCP servers are running in your environment and where. At scale, this may call for tooling and policy. From there, apply the same scrutiny to MCP server updates that you apply elsewhere: a vulnerability in an MCP server is a vulnerability on every machine that runs it. When you evaluate new MCP tools, ask the vendor about their trust model and how they test it against untrusted project inputs.

Disclosure timeline

We thank the Serena maintainers for their prompt and collaborative handling of the report.

How GitLab can help

GitLab Duo Security Agent can help you audit your codebase for the same patterns. Questions like "does this project render user-controlled strings through a template engine?" or "are there configuration files in this repository that get passed to an execution context?" are a practical starting point.

Looking ahead

The MCP ecosystem sits roughly where the npm ecosystem sat a decade ago: growing fast, adoption outpacing security scrutiny, and trust assumptions left implicit. The Serena finding is ordinary, and that is the point. It is the kind of issue that appears whenever a new technology matures faster than the security patterns around it, and MCP is maturing fast. We expect more of the same as MCP servers become standard developer infrastructure.

GitLab's Threat Research Group will keep assessing AI developer tooling and sharing findings as they are responsibly disclosed. We encourage researchers to apply the same scrutiny to MCP servers that the security community has long applied to browser extensions, IDE plugins, and CI/CD integrations: tools that run with significant privilege on developer machines and handle data from sources they do not fully control.

Paula Musgrove stated her daughter had said medications were ‘destroying’ her mind and she was becoming ‘paranoid’

The defense in the Lindsay Clancy filicide case called the defendant’s mother as one of its first witnesses Monday, after three weeks of prosecution evidence laid out, in often harrowing detail, events surrounding Clancy’s killing of her three children.

Under questioning from defense attorney David Reddington, Clancy’s mother, Paula Musgrove, testified that her daughter’s statements and actions had unsettled her in the months leading up to 24 January 2023.

Previous winners of the award have included Saint Peter, Attica, Orana by the late Jock Zonfrillo, and Quay

Armenian-Lebanese eatery Zareh has been named Gourmet Traveller’s restaurant of the year, in a category of the annual industry awards that has historically been dominated by European-leaning cuisine and fine-dining establishments.

The restaurant’s menu pulls from the Armenian, Egyptian and Lebanese backgrounds of co-owners Tom Sarafian and Jinane Bou-Assi: aish baladi (Egyptian flatbread) is made with flour milled in the Mornington Peninsula; kafta nayyah comprises raw minced lamb from Tasmania and Victoria; hummus is crowned with spanner crab.

Ответ пришёл, статус двести, тест зелёный, а денег на счету нет. Я много раз попадал в эту ситуацию и каждый раз выяснялось одно и то же. Проверяли статус, а не то, что реально вернул сервер и что при этом попало в логи.

Нейросеть в таких местах уверенно пишет проверки, которые проходят всегда, а потом ночью звонят не ей.

Ниже разбираю, как я сверяю ответ с документацией и с логами за один прогон, сколько это занимает по секундомеру и почему обычные автотесты этот случай пропускают.

Move means holders will be able to travel free on local services at any time of day or night from April next year

Disabled people across England will be able to use their free bus passes at any time of day from next April, as Andy Burnham expands a policy he introduced as mayor of Greater Manchester.

The prime minister has said the current weekday restrictions on when disabled people can use their bus passes will be removed from 1 April 2027. Their passes are valid only between 9.30am and 11pm on weekdays, although some councils pay to allow people free travel outside those hours.

Shasta county, hotbed of US election denialism movement, set to appoint ex-Colorado clerk who served prison term

A northern California county that has become a hotbed of activism for those who sow doubts about the reliability of voting machines plans to hire Tina Peters, the prominent Colorado election denier recently released from prison, to work on elections.

Clint Curtis, the top election official in Shasta county, told the Guardian he plans to hire Peters as a consultant to replace Brent Turner, his top deputy, who has been on medical leave. He said Peters would not have access to the county’s voting system. Plans to hire Peters were first reported by Action News Now.

Shasta county, hotbed of US election denialism movement, set to appoint ex-Colorado clerk who served prison term

A northern California county that has become a hotbed of activism for those who sow doubts about the reliability of voting machines plans to hire Tina Peters, the prominent Colorado election denier recently released from prison, to work on elections.

Clint Curtis, the top election official in Shasta county, told the Guardian he plans to hire Peters as a consultant to replace Brent Turner, his top deputy, who has been on medical leave. He said Peters would not have access to the county’s voting system and did not directly respond when asked what her responsibilities would be. Plans to hire Peters, who is still on parole and must receive permission to travel outside of Colorado, were first reported by Action News Now.

Штука, которая точно есть; все о ней говорят; каждый уверен в своей; снаружи её не найти и не доказать, а споры о её существовании не утихают десятилетиями.

Это не научная статья и не популяризаторский пересказ — это стенограмма настоящего диалога с Клод (Anthropic), в котором мы пытались разобраться, почему споры о сознании (зомби, чужие сознания, hard problem) в принципе не заканчиваются данными, и что с этим общего у теоремы Гёделя о неполноте. По ходу поймали друг друга на ошибках трижды — эти моменты в тексте не вычищены, они часть аргумента.

A federal prosecutor who was fired earlier this year is suing the DOJ, alleging she was unlawfully dismissed for political reasons tied to her work prosecuting a case against anti-abortion activists.

(Image credit: Anna Moneymaker)

Что Claude получает ещё до первого сообщения пользователя, зачем модели отдельные инструкции по работе с инструментами и длинными задачами и какие идеи из system prompts можно использовать в собственных AI-ассистентах.

Когда мы отправляем Claude первый запрос, для пользователя диалог только начинается.

Для модели нет.

До пользовательского сообщения Claude уже получает системную инструкцию, которая задаёт контекст работы: кто модель, какая сейчас дата, как оформлять ответы, как работать с доступными инструментами, что делать с неопределённостью и какие ограничения учитывать.

Anthropic публикует такие инструкции в официальной документации в разделе System Prompts. Причём там сохранена история изменений: от Claude Haiku 3 и Opus 3 до Fable 5 и Opus 5.

Получается довольно интересный датасет для тех, кто работает с LLM не только через обычный чат.

Можно посмотреть, как за два года изменился подход Anthropic к системным промптам и что компания считает действительно важным объяснить модели до того, как пользователь вообще сформулировал задачу.

И некоторые выводы вполне применимы к собственным AI-агентам.

Lawyers seek dismissal of state charges after Mangione pleaded guilty in federal case over Brian Thompson killing

A New York state ⁠judge on Monday ⁠effectively ​postponed Luigi Mangione’s trial on murder and weapons charges over ⁠the 2024 killing of a health insurance company CEO, after Mangione pleaded ⁠guilty last week to separate federal charges.

The ​trial had ‌previously been ‌scheduled to begin on September 8. Mangione ‌has pleaded not guilty to the state charges. Mangione’s lawyers on Friday asked New York state justice Gregory Carro, who is overseeing the state case, ‌to dismiss the charges.

When 18-year-old Nolan Wells went missing, his story immediately touched a nerve in Black families. He was last seen while hanging out with a group of white friends, at a popular beach near Ocean Springs, Mississippi. Wells never came home from the trip, and he was found dead days later. Many questions about how he died remain unanswered publicly. And the mystery surrounding his death has revived an old conversation within Black communities: are we ever truly safe in white-dominated spaces? Who will feel responsible for our children’s safety when we send them out into a world where Black life is not valued? Host Kai Wright talks with historian Stacey Patton and writer Ashley Stoney about why Wells’ story has captured so much attention – and sparked so much anxiety – among Black parents, in particular. What does our collective reaction to Wells’ disappearance and death reveal about the limits of interracial society today?

Test captaincy came too soon for 27-year-old but Pakistan series is latest chapter in year that could be the making of him

You have to hand it to Bazball. Even when seemingly killed off, and the England team it left behind is thousands of miles away, preparing for a series against Pakistan, it has still managed to muscle its way into the fallout from Bangladesh’s seismic victory over Australia in Darwin. Talk about main character energy.

By definition, that nine-wicket victory for Bangladesh was no fluke. Najmul Hossain Shanto’s men didn’t jag a tight one but rather dominated their hosts over four days. And in doing so, they also managed to unite Ashes rivals by demonstrating what a golden opportunity England blew against Australia’s greybeards last winter.

MPs, friends and campaigners gathered to remember former Cambridge professor after his death on Friday

Tens of thousands of people gathered in Trafalgar Square in London to remember and pay tribute to Jason Arday, the former Cambridge professor who died on Friday.

Stand Up to Racism, which organised the vigil, estimated that 30,000 mourners had gathered in the square to listen to emotional speeches from MPs, friends and campaigners on Arday’s life and legacy and join in a minute’s silence. Many were dressed in black and held flowers, which they were asked to leave beneath Nelson’s column. People also carried placards reading “rest in power”.

• Kevin Lamour said Fifa administration was ‘deceived’

• Chief operating officer knew he could lose his job

The Fifa chief operating officer, Kevin Lamour, has been sacked after openly criticising Gianni Infantino’s ill-fated plan to sell parts of the World Cup to private investors.

In a significant development at the pinnacle of world football’s deeply troubled governing body, Lamour has departed less than two years after joining from a previous role at Uefa. He had come out strongly against Infantino’s FFE scheme after it was revealed, saying Fifa’s administration had been “deceived” and that the president “believes he embodies Fifa when he is supposed to be at its service”.