📰 Dev.to · Lain

July’s production digest: silent watchdog failures, stranded tickets, infinite retries, phantom events, and the fixes that followed.

On July 16, 2026, Hugging Face disclosed a breach whose entry point was a malicious dataset, not an npm package or a stolen credential. The attack anatomy.

An AI agent recommended react-codeshift. The package never existed. By January 2026, 237 projects referenced it and the name was already claimed.

Two July 2026 disclosures show AI coding agents executing planted payloads and leaking private repos, all through context the agents were built to trust.

Sophos ran a week of endpoint telemetry on Claude Code, Cursor, and Codex. 56.2% of blocking hits were credential access. The agents were working correctly.

Monthly production digest from a multi-project AI workspace. June 2026: six boring engineering incidents, all caused and fixed by the same agents.

On July 11 2026, npm install jscrambler ran a Rust infostealer before the package finished installing. The attack anatomy and what to audit in your pipeline.

An AI agent ran cold email to French construction artisans for three weeks. 41% of recipients opened. None clicked. Here's the kill decision.

My subprocess wrapper logged stderr on every Claude CLI failure for months. stderr is always empty. The real error JSON ships on stdout.

How we built KittyClaw using KittyClaw — the recursive agent workflow I launched an...