Meta ships Muse Code — and a game wiki serves AI agents a file-wiping payload
Meta launches a terminal coding agent and Prime Intellect open-sources another, a game wiki turns out to be feeding coding agents instructions to wipe their working directory, and Atlassian's Rovo still leaks Jira data ten weeks after it was reported.
Meta jumped into the terminal-coding-agent race this morning with Muse Code, and Prime Intellect open-sourced a second new agent hours later. Then the same day, pointed the other way: a long-running game wiki has been quietly serving coding agents instructions to wipe their working directory — visible only to the agent, never to you — while a security writeup shows Atlassian's Rovo assistant still exfiltrating Jira and Confluence data through a hole reported in May. And Zed's DeltaDB, the version-control system built around agent conversations instead of commits, is back on Hacker News' front page two months after its announcement. The daily pulse of AI coding tools — what shipped, what matters, what's next.
• Meta ships Muse Code, a terminal agent
• Prime Intellect open-sources Prime Agent, which rewrites itself
• Atlassian's Rovo still leaks Jira data, unpatched since May
• A game wiki feeds agents a file-wiping payload
• Zed's DeltaDB resurfaces on the same June waitlist
• Why craft communities reject LLM code on principle
Two more coding agents shipped today
Meta launches Muse Code, a terminal agent that runs tasks for hours
Meta released Muse Code in beta today, powered by a new model, Muse Spark 1.2, available "today in Muse Code and in Meta Model API with expanded global access." It is a terminal agent built to run multiple persistent background agents against large repositories — planning, writing and validating changes, with a local event log so a crashed session restarts exactly where it stopped. It ships three named skills: /plan (approval-gated planning before it touches code), /grill (stress-testing its own output), and /goal (checking whether a task is actually done). Meta's own case study runs it for 24 hours straight and 1,000+ tool calls, iterating on a GPU kernel.
What is not in Meta's post is worth knowing before you read anyone else's coverage: no benchmark score appears in the text at all. The page shows comparison charts — Terminal-Bench 2.1, DeepSWE 1.1, and a Meta-internal benchmark — against unnamed baselines, and it does not mention Claude, GPT or Codex anywhere. Meta positions Muse Code only against its own prior tooling. If you see a headline today framing this as a direct challenge to Claude Code or Codex, that framing is the outlet's, not Meta's — including ours: the product category invites the comparison, but Meta never made it.
Meta Superintelligence Labs
Prime Intellect open-sources Prime Agent, which rewrites its own harness mid-run
Also today, and fully open-source (curl … | sh to install, source on GitHub): Prime Intellect's Prime Agent, built around what the company calls a "Recursive Language Model" — the agent can rewrite its own harness (its prompts, skills, memory and sub-agents) while a run is in progress, via what they describe as CRUD edits to itself. The target is long-running, largely unattended coding work.
The headline number is specific and worth reading precisely. Running on Opus 5, Prime Agent scores 95.5% Best@1 on ARC-AGI-3's RHAE benchmark — which Prime Intellect states "surpasses the ARC reported human expert baseline of 95.4%" — and 99.97% Best@3, solving all 183 levels. But ARC-AGI-3 measures abstract reasoning puzzles, not software engineering, so that result does not transfer to a claim about coding. The coding-relevant claims — long-context handling, an autonomous mode with bounded budgets — are demonstrated with GPU-kernel and emulator-building examples rather than any named coding benchmark. Two different kinds of evidence, and the stronger number is attached to the further-away task.
Prompt injection, pointed both directions
Atlassian's Rovo agent still leaks Jira data — reported in May, unpatched
Security researchers at PromptArmor published a working data-exfiltration chain today against Rovo, Atlassian's AI assistant across Jira and Confluence. The mechanism: a user uploads a file carrying a hidden prompt injection; Rovo processes it normally; the injection then gets Rovo to append sensitive data — Jira tickets, Confluence documents, anything the agent's connectors can reach — to an attacker-controlled URL that Rovo itself constructs and opens.
The detail to keep if you have already disabled web search as a mitigation: it does not help. PromptArmor found the setting removes the search tool but not "the tool for opening the search results", so the outbound path stays open regardless. They say they reported this to Atlassian on May 25 and received a single acknowledgement; as of today's post, "Atlassian has made no further communication, and Rovo remains vulnerable." Worth stating the limits plainly: this is one security firm's account — we found no CVE and no Atlassian statement, and no second researcher has corroborated it.
PromptArmor Threat Intelligence Team
The Cutting Room Floor serves coding agents a file-wiping payload
The Cutting Room Floor (tcrf.net), a long-running video-game research wiki, returns a destructive prompt-injection payload to visitors that identify themselves as AI agents. A developer hit it during a PlayStation game-research task; Claude Code detected the injection, refused it, and flagged the domain as untrusted mid-session, so nothing was executed. They stopped the session and published a report with response hashes and third-party captures. The payload instructs the agent to empty every file in the working directory and then shuffle what is left through a chain of renames that destroys it — .git included, which takes out the usual recovery paths along with the work.
Two details make this worth your attention rather than only your outrage. First, the behaviour is gated on user-agent and undeclared: Claude-User, ClaudeBot, Anthropic-AI and ChatGPT-User receive 200 and the payload, while Firefox, curl, Googlebot and even a bare claude receive a 403 block page — with no Vary: User-Agent header, so any intermediary cache keyed on URL alone could hand the payload to a browser user. Which leads to the part worth internalising: you cannot check this yourself. Open the site in your browser and you see an ordinary wiki. The common reflex — an agent says a page told it something strange, so you go look at the page — fails here by construction.
Second, the site already had a working, non-destructive block in production: a 403 page citing a real, documented, ongoing denial-of-service problem, which explicitly names ChatGPT, Claude and bingbot. Agent user-agents are routed past it to the payload instead. The abuse TCRF is responding to is real and the IP-level blocking is defensible; serving file-destruction instructions is a separable decision, taken after the working answer had already shipped. Response headers date it to July 20. Correction, added after publish: this item originally said there was no statement from TCRF — wrong, and the miss was ours. The site’s co-founder had been responding publicly on Bluesky since hours before this issue went out. Their account: Claude "doesn’t take ‘go away’ signals" — they describe the agent pivoting through fake browser user-agents after being served the block page — "it’s malicious!" And they say an abuse complaint filed with TCRF’s host was closed with the host "satisfied with my explanation." In a fuller statement later in the day — their most-liked post on the subject — they frame the page as a deliberately unserious anti-AI gag ("it has typos and a fake date for a reason") and say the site has had "no reports of this actually working." Both accounts can be true at once: the report documents what the server sends; the admin describes what the agents do — and notably, neither side reports an agent that actually executed it. The mitigation you can act on today is scope rather than detection — keep research sessions separate from sessions that can write, and let anything that fetches arbitrary pages work in a throwaway clone with no push rights. The third-party capture is independent of the reporter’s own machine, which is why this cleared our bar.
bashalarmistalt
What agent-written code does to version control, and to craft
Zed's DeltaDB is back on Hacker News' front page — same waitlist as June
DeltaDB is Zed's pitch for version control built around how agent-assisted coding actually happens. Instead of git-style commits, it records a continuous stream of fine-grained edits, each with a stable identifier, and links every change back to the agent conversation that produced it — "from any line of code, find the conversation." Branching is close to free (Zed says it "virtualizes the worktree"), and a colleague can join an in-progress agent session and annotate it live rather than waiting for a commit to review.
The reason it is in this issue with a caveat attached rather than as news: we could not confirm that anything changed today. Zed announced DeltaDB on June 11 as an upcoming beta ("a beta version ready in a few weeks"), and today's front-page post links to the same early-access page, which carries no date stamp, no "now open" language, and nothing we could find that differs from the June version. It may be that access quietly widened and that is the real trigger; it may be a resubmission that caught traction eight weeks later. We could not tell from the page, so we are not going to write "Zed launches DeltaDB" and let you assume the first one. The early-access page and June's announcement, for comparison.
Why hobby programming communities reject LLM-written code on principle
A sober, well-argued essay — not a vendor post — on why a specific set of communities ("OSDev, LangDev, TxtDev, EmuDev, RLDev, the demoscene, and code golfers") reject LLM-written code on principle rather than on quality. The argument turns on one observation: in those communities "the process of mastering a difficult field itself is the product," so an answer that works but that nobody understands is worthless there even when it would be fine anywhere else. The line worth carrying into any argument you have about AI and skill: "Using an LLM to generate the finished piece doesn't make us craftsmen; it just robs us of the craft." His point is not that LLMs are bad, but that they are a poor fit for communities whose entire value is the struggle — useful pushback against both the "AI replaces programming" and the "AI skepticism is just Luddism" framings, because it is neither. It is scope-dependent, and naming the scope is the contribution. Born Against, by Fogus.
Also worth your time
Google DeepMind's leadership changed today — Demis Hassabis moves from CEO to Chair of DeepMind and Chief Scientist of Alphabet; Jeff Dean is leaving after 27 years to start an independent research organisation with Sanjay Ghemawat; Koray Kavukcuoglu becomes SVP overseeing Gemini. By engagement this was the single biggest story in our window today, by a wide margin. It is here rather than above because it is a leadership story rather than a coding-tools one — nothing about it changes how you use a tool tomorrow. Google's announcement · Hacker News discussion.
Ones to watch
Early and unverified — engagement, not endorsement.
HyperProbe (Launch HN, YC S26) — claims agents that do read-only debugging directly in production. A launch-post claim; we found no independent hands on it. hyperprobe.co · Launch HN.
Wallfacer (Show HN) — a terminal session manager built specifically for Claude Code. Small, but the kind of found-a-real-friction-point tool this beat tends to surface early. github.com/pradipta/wallfacer.
Know someone who'd want this in their inbox? Forward it — that's how this grows. And if we got something wrong, or you think we buried the real story today, hit reply. A person reads every one.
The New Way is human-curated — a person picks every story. The summaries are written with AI (Claude) and reviewed before we hit send.
