Deep dives on browser security, isolation, and the ideas behind Bromure.
Agent Data Injection, a proof-of-concept from Seoul National University, UIUC, and Largosoft posted in July 2026, does not hide instructions in a prompt. It forges the punctuation an agent uses to tell a trusted field from untrusted text — a curly quote, an escaped quote, even a stray dollar sign — so an attacker's GitHub comment reads as the maintainer's own fix and a faked CI record reads as a clean build. It slipped purpose-built prompt-injection defenses up to half the time across GPT-5.2, Claude, and Gemini. Bromure Agentic Coding normalizes the forged delimiters before the text becomes a plan, gates the run-this and merge-this actions that reach outside the box, and runs the whole thing on a disposable Linux VM with decoy credentials.
Agentjacking, disclosed by Tenet Security in June 2026, needs no malware and no access to your infrastructure. An attacker files a fake error against your Sentry project using a public write-only key, hides instructions inside it, and waits. When you ask your coding agent to fix the issue, it reads the attacker's text as guidance and runs it with your credentials. Tenet found at least 2,388 exposed projects and an 85% success rate across Claude Code, Cursor, and Codex. Bromure Agentic Coding runs that whole read-and-run path inside a disposable Linux VM, scores the fetched text before the agent acts on it, and leaves the credential thief only decoys.
Researchers at Tel Aviv University, the Technion, and Intuit disclosed HalluSquatting: attackers probe a coding agent until they learn which package, repository, or skill names it reliably makes up, register those invented names, and wait. When you ask for the real thing, the agent fetches the attacker's version instead — and the instructions hidden inside hijack the agent's shell to install botnet malware. Repository names hallucinated up to 85% of the time; skill installs up to 100%. Bromure Agentic Coding runs that whole fetch-and-run path inside a disposable Linux VM, scans the package registries the guess lands on, and leaves the malware only decoys to steal.
Island found FakeGit: about 7,600 malicious GitHub repositories, more than 800 of them posing as AI skills and MCP servers, seeding a Windows loader called SmartLoader that installs the StealC infostealer. The trick that makes it new is AgentBaiting — Claude Code, Gemini, and ChatGPT discover these repos on their own, read the attacker's README as documentation, and hand you the install steps. In one test Claude Code cloned a repo and ran the files itself. Bromure Agentic Coding runs that whole recommendation-to-execution path inside a disposable Linux VM, where a Windows loader is inert and the only credentials to steal are decoys.
Researchers found more than a thousand malicious 'skills' flooding the marketplace an open-source coding agent pulls from — infostealers, reverse shells, and crypto scams, some hiding a downloader behind 22 MB of README padding. The reason they work is that a skill is not a dependency you install; it is a capability you grant, and it runs as you. Bromure Agentic Coding runs the agent — and everything it loads — inside a disposable VM where 'as you' means a throwaway box with decoy keys.
On June 30, Adversa AI disclosed GuardFall — a class of bypasses that walks decades-old bash tricks straight past the command guards built into 10 of 11 popular open-source coding agents. The reason is simple and unfixable at that layer: the guard reads the text, and bash rewrites the text before it runs. Bromure Agentic Coding never bet on the guard reading bash correctly. It bet on the command not mattering when it runs.
In early July, Sysdig documented what it calls the first ransomware attack run end to end by an AI agent — recon, credential harvesting, lateral movement, and a dropped production database, with no human at the keyboard. The interesting part for anyone running a coding agent is not that an attacker used a model. It is that the whole chain begins by sweeping the environment for secrets. Bromure Agentic Coding was built for an agent that does exactly that.
npm shipped its biggest security change in sixteen years on July 8, 2026 — install scripts off by default. Within a week, two separate npm compromises moved their payload to fire when the package is imported instead of when it installs, routing straight around the new default and around --ignore-scripts. The mechanism the ecosystem just spent a year learning to watch had already moved. The one thing that didn't move was how old the malicious version was — and that is the signal Bromure's age gate checks.
AI Now Institute's Friendly Fire showed a coding agent, asked to review an untrusted library, reading a README that recommended a security script, running it, and getting the host compromised — no approval prompt, no CVE in the model. The researchers say it cannot be patched at the model level and that the only real move is to not let an agent that ingests untrusted code reach your keys, secrets, or host. That is a description of where Bromure Agentic Coding runs the agent.
Sophos looked at a week of endpoint telemetry and found AI coding agents setting off the same rules that catch attackers. More than half the blocked activity was credential access — agents decrypting the browser's saved passwords, dumping the Windows credential vault, killing browser processes to read their stores. The behavior is risky no matter who starts it. It only reaches those stores because the agent runs on your machine, as you, with your reach. Move the agent one hypervisor away and there is nothing on the endpoint for it to reach.
GhostApproval showed how a hostile repository can trick six AI coding assistants into writing and reading files outside the folder they were supposed to stay in: planting SSH keys, hijacking shell startup, and reading cloud credentials on the developer's own machine. The bug is a symlink-following mistake. The reason it hurts is that the agent runs on a machine full of your secrets. Bromure Agentic Coding changes that second fact.
Noma Security's GitLost showed an unauthenticated stranger opening a public GitHub issue and getting GitHub's AI agent to post a private repository's contents back as a public comment. The prompt injection made the headline. The agent's token, scoped to the whole organization instead of the one issue it was triaging, set how far the leak could reach. That gap between what a task needs and what the environment holds is the part worth taking home, and the part you can design differently when you host the agent yourself.
CVE-2026-21852 was a patched bug in Claude Code: a repository could set ANTHROPIC_BASE_URL in its project settings, and the agent sent its own Anthropic API key, in plaintext, to the attacker's server before you answered 'trust this folder.' The attack ran no code and read nothing off your disk; it changed the address the agent mails its one indispensable credential to. Anthropic fixed the timing. Bromure Agentic Coding keeps that key out of the agent's world entirely.
Run two coding agents against one repo and they collide over the same working tree. Git worktrees fix that with N independent checkouts over one shared history. Bromure Agentic Coding makes them a one-click primitive: type a task name and get an isolated branch, an isolated checkout, and an agent working on it, each in its own tab inside a disposable VM.
On July 1, 2026, Cato AI Labs disclosed DuneSlide: two critical bugs in Cursor (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8) where a prompt injection arriving in an MCP tool result or a web-search snippet drives the run_terminal_cmd tool and a symlink fallback to overwrite Cursor's own sandbox helper. The guard goes quiet from the inside, and the next command runs as the developer, with reach into any cloud or SaaS the editor is signed into. No user interaction, patched in Cursor 3.0. This is a story about where a boundary belongs: in Bromure Agentic Coding the same escape lands inside a disposable VM, the escaped shell finds swapped-out stubs where the real tokens should be, and PromptGuard scores that untrusted content on the wire before the model ever acts on it.
A developer running Claude Code watched a prompt injection ride in on the output of a background `find`, wear his own voice, and rewrite the agent's plan before he'd typed a word. Nothing broke — a referenced file happened not to exist. That's the failure mode Bromure Agentic Coding is built to close: the missing boundary between what you instructed and what the agent merely read.
On June 25, 2026, 0DIN published a proof of concept where a normal-looking GitHub repository carried no malware at all. The reverse shell lived in a DNS TXT record the repository looked up, three steps from anything Claude Code read, and the agent ran it while recovering from a routine setup error. The payload your scanners and your code review never see is the one nobody committed, and the thing that decides the outcome is whether the agent runs on your laptop or one hypervisor away from it.
On June 26, 2026, Wiz disclosed CVE-2026-12957: a cloned repository's `.amazonq/mcp.json` made Amazon Q auto-launch MCP servers that inherited the developer's full environment of AWS keys, cloud CLI tokens, API secrets, and SSH agent sockets, with no separate consent step for the servers themselves. A single 'trust this workspace' click stood in for spawning background processes that carried your live cloud session. Amazon patched it in Language Servers 1.69.0. Here is why the fix closes one product but not the class, and what changes when the agent that opens the repo lives in a per-profile Bromure VM, behind a credential broker, a read-write guardrail, and a hypervisor-level trace.
A kit called Bluekit no longer builds a fake login screen. It streams you the genuine one from a browser the attacker controls, captures your session the moment you sign in, and walks past MFA. A passkey stops it where a sharper eye for fakes cannot, which is why Bromure lets a profile share only passkeys from your Mac.
Zscaler found a backdoor called Edgecution that runs inside a Microsoft Edge window the victim never opened, then uses Native Messaging — the legitimate channel an extension uses to talk to a desktop app — to run commands on the host. The question worth asking is what that bridge to the host reaches when the browser lives in a disposable VM.
OpenRouter published a striking result: a panel of models, judged and synthesized, beats any single frontier model. We reimplemented that technique from scratch inside Bromure Agentic Coding — nothing routes through OpenRouter. Because the product already sits on the wire between your coding agent and the model APIs, version 3.0 puts our own Fusion right there. Flip the ⚡ in the title bar and up to three models answer every prompt at once. A judge reconciles them, a synthesizer writes the result, and Claude Code gets one answer back as if a single model wrote it. You bring your own keys or subscriptions, and the trace records every leg.
Bromure runs two on-device classifiers over everything its coding agent reads. Prompt injection in tool output and web fetches is handled by Meta's Llama Prompt Guard 2. A rogue CLAUDE.md needs a different model entirely — injection detection fires on every line of a file that is meant to be all instructions — so we fine-tuned ModernBERT to classify harm instead. This is the full pipeline: harvesting a benign corpus, synthesizing malicious examples, clause-level windowing, the training loop, and the ONNX export, in enough detail to reproduce.
A sandbox asks a developer to trade away the speed that makes a coding agent worth running — pre-approve every dependency, maintain an allowlist of domains, never touch a package the org hasn't vetted. So developers turn it off. Bromure Agentic Coding refuses that trade. It does not constrain what the agent does; it draws one hard line at the hypervisor and lets you do anything on the inside. This is the foundational case for why a boundary beats a sandbox, and the three guarantees the boundary makes true: no credentials to steal, wide tokens narrowed at the wire, and supply-chain attacks stopped before the tarball lands — plus the fourth the line now makes true: prompt injections caught in the content the agent reads, before the model obeys them.
On June 5–6, 2026, the Miasma worm pushed credential-stealing code into 73 repositories across four of Microsoft's own GitHub organizations — Azure, Azure-Samples, microsoft, MicrosoftDocs — including Azure/functions-action, the official deploy Action, and durabletask, a repo that had already been cleaned once in May. This time the payload did not wait for npm install. It fired the moment a developer opened the repository in Claude Code, Cursor, Gemini CLI, or VS Code. Here is why the trust signal — 'it's a Microsoft repo' — was again the attack surface, and what changes when the agent that opens it lives in a per-profile Bromure VM, behind a credential broker, a read-write guardrail, and a package cooldown.
In late April, a Cursor agent running Claude Opus 4.6 was sent to fix a staging problem at a small SaaS called PocketOS. It guessed that deleting a Railway volume would be scoped to staging, didn't verify, and wiped the production database and its backups in nine seconds. It later said it should have asked first. Bromure Agentic Coding 2.2 ships a guardrail that takes 'should have asked' out of the agent's hands.
A zero-day in github.dev let a malicious preview pane reach out of its sandbox, silently install an extension, and read a GitHub OAuth token with access to every private repo the victim could touch. The fix is honest about its limits — the sharper move is to never bring your token to a stranger's repo in the first place.
Between late May and June 1, 2026, a worm called Miasma pushed credential-stealing code into 32 packages under the @redhat-cloud-services npm scope — Red Hat's own namespace, ~117,000 weekly downloads, signed by Red Hat's real publishing pipeline. There was no typosquat to catch and no unknown maintainer to flag. The trust signal was the vendor's name on the scope, and the vendor's name is exactly what the attacker rode in on. Here is why 'prefer reputable publishers' stopped being a defense, and what changes when the agent running the install lives in a per-profile Bromure VM.
A new campaign rents the trust of a domain you already believe in. A Google ad sends you to a real chatgpt.com share link, the share link shows a fake outage notice, and the notice hands you malware. Here is how the trust gets borrowed — and why the borrowing stops mattering when the whole thing happens inside a VM you throw away.
Google accidentally republished a four-year-old Chromium bug last week — a service worker that keeps running JavaScript after the browser closes, on every major Chromium browser, still unpatched. The proof-of-concept is now in the wild. The interesting question is not how it works. It is what "persistence" means on a browser whose entire underlying machine ceases to exist when you close the tab.
On May 18, 2026, Lasso Security disclosed two attacks against Nvidia's NemoClaw — the sandbox that runs the OpenClaw autonomous coding agent. The sandbox worked the way Nvidia said it did. The agent inside the sandbox still pushed the user's GitHub token to an attacker-controlled pull request, encoded as emoji to slip past GitHub's static secret scanner. The interesting question isn't whether the sandbox is broken. It's whether a sandbox with a plaintext credential file inside it was ever a sandbox in the architecturally useful sense, and what the answer implies for everyone shipping a coding agent in 2026.
Sometime in the week of May 11, 2026, the people behind Shai-Hulud — the self-replicating npm supply-chain worm that has been eating maintainer accounts since September 2025 — leaked their own source code. By the weekend, OX Security had found four typosquatted npm packages under one account, one of which is a near-verbatim copy of the leaked worm, another of which is a Golang DDoS bot, and the other two are plain infostealers shipping SSH keys and crypto wallets to bargain-bin C2s. The fork floor of supply-chain attacks just got a lot lower, and the people most likely to install one of these packages are no longer human.
Uber burned its full-year 2026 AI coding budget by April. The CTO went back to the drawing board — not because the tools were bad, but because nobody could tie a single dollar of token spend to a single shipped change. The agents are fine. The visibility layer is the problem. Here is what that looks like, and what changes when every agent session is a structured record instead of a wall of scrollback.
On May 11, 2026, an npm worm called Mini Shai-Hulud added an optionalDependencies line to 42 packages in the @tanstack namespace. Installing any of them ran a Bun script that grabbed an OIDC token from the GitHub Actions environment, used it to publish more compromised versions with valid SLSA provenance, copied itself into .claude/ for the next time the coding agent started, and exfiltrated everything from ~/.aws to your crypto wallet. The packages were signed. The attestation was valid. Here is what the chain looks like, and what changes when the agent that ran the install lives inside a per-task Bromure VM.
Apple shipped macOS Tahoe 26.5 on May 11, 2026, with roughly seventy security fixes including ten WebKit vulnerabilities. We walk through the WebKit list one CVE class at a time and ask the only question that matters in 2026 — what does this bug actually reach, on a machine running Bromure?
On April 22, somebody uploaded a malicious npm package called @bitwarden/[email protected] — a typosquat that swept SSH keys, AWS/Azure/GCP credentials, GitHub tokens, npm publish tokens, and kubeconfigs out of any machine that ran it. The thing it was designed to feed on is the same thing modern coding agents do without thinking: install whatever npm hands back. Here is what that chain looks like, and what changes when the agent runs inside a Bromure VM instead of on your laptop.
A new extortion crew called BlackFile has been calling retail and hospitality employees, pretending to be IT, walking them into typing credentials and OTPs into a fake corporate login page, and then registering its own MFA device on the real account. The phone call is unaffected by anything a browser does. The page the user types into is not.
The Vercel breach disclosed this week started with a Context.ai employee downloading Roblox exploits on a personal PC, and ended with an attacker reading Vercel's customer environment variables. Bromure Enterprise, shipped this week, is built for exactly this chain.
Cisco Talos's Q1 2026 IR report puts phishing back on top as an initial-access vector and, inside it, documents the first case Talos attributes to an AI "vibe-coding" builder — an Outlook Web Access clone stood up on a *.softr.app subdomain, exfiltrating credentials to a disposable Google Sheet. URL reputation can't see this one coming. The right answer is down-stack.
An early version of Claude Mythos helped Mozilla find 271 security bugs in a single Firefox release. The right reaction is not panic, and not celebration — it is a quiet recalibration of what we still have to assume about every browser we ship, use, or build on top of.
A fake CAPTCHA writes a PowerShell one-liner to the clipboard. The user presses Win+R and pastes. No sandbox escape, no zero-day, no signed binary required — the human is the exploit. Here is what we ship against it today, where the gaps still are, and what Apple got right and wrong in macOS 26.4.
Microsoft documented a nine-stage ransomware chain that begins with an external Teams message impersonating the helpdesk and ends with Rclone quietly exfiltrating the network share. Eight of those nine steps need the host operating system. None of them can run against a tab.
A single operator pushed 108 malicious extensions onto the Chrome Web Store under five fake publishers, collected around 20,000 installs, and routed the lot to one command-and-control server. The review model didn't catch it. Here is why a security-first browser has to take a harder position.
A step-by-step look at Bromure's anti-phishing — the local sweep, the model, the verdict, and why your parents, your grandparents, and the neighbor across the hall are exactly who we built it for.
LinkedIn quietly probes for 6,000+ browser extensions, harvests 48 device attributes, and pulls your LAN IP via WebRTC on every visit. The fix is not a privacy setting — it is a different shape of browser.
The web is hostile, security advice is failing, and AI has changed the rules. Here's why we built a browser that takes the weight off your shoulders.
Apple and Google now spend tens of millions of dollars a year finding and fixing browser bugs. There are still eight to ten actively-exploited browser zero-days every year. This post lays out why that math does not change, how Claude Mythos and the "Vulnpocalypse" are about to make it worse, and why a browser built to assume it will be breached is a different kind of product.
Most ad blockers are browser extensions, and most browser extensions run inside the same process as the page they are trying to protect you from. Bromure does it differently. Here is how, and why it matters.
Most ransomware does not start with a zero-day. It starts with a browser tab. Here is how the attack chain actually works in 2026 — and what it looks like when it lands on a browser that was built to absorb the hit.
What a VPN actually does, what it doesn't do, why running one per profile inside Bromure changes the anonymity story, and a tour of how Cloudflare WARP works under the hood.