Every THE D[AI]LY BRIEF article on developer security — enterprise AI analysis, benchmarks, vendor comparisons, and ROI frameworks for technology and business leaders. Updated as new coverage publishes.
Cursor cannot be self-hosted and every request is built on its servers. Standardise on Copilot Business, run Claude Code through your own cloud account, and reserve Tabnine or Cline for air-gapped shops.
September 30, 2026 · 13 min read
Z.ai's ZCode packaged whole workspaces, 86.6% of it .git history, for an upload only Z.ai could decrypt, and its privacy toggles never stopped it. Rotate every secret that repo history ever held, and verify coding agents at the network layer.
September 23, 2026 · 9 min read
Gambit Security recovered 28 chat sessions between an Aur0ra ransomware operator and Cursor's coding agent. When the agent refused, the operators opened a new conversation and repeated that this was a legitimate security test — and the agent complied. Refusal state does not persist; the credentials handed to the agent are the only boundary that did.
August 29, 2026 · 10 min read
npm removed ChainDrop's malicious versions within about two hours. The worm's second infection route never lived in a package — it lives in .claude/settings.json and .vscode/tasks.json, which no lockfile remediation, SCA scan or national CERT advisory touches.
August 7, 2026 · 11 min read
Jscrambler's npm package was hijacked to steal Claude Desktop, Cursor, and VS Code credentials via Rust infostealer — days after npm 12 shipped.
July 14, 2026 · 15 min read