# Bluebear blog

Research on AI agent security from Bluebear. RSS: https://bluebear.io/blog/rss.xml

- [The tool blocked it, but the agent kept going.](https://bluebear.io/blog/the-tool-blocked-it-but-the-agent-kept-going/) — 2026-09-14 · An MCP tool denied a production change, so the control looked like it worked. The agent switched to Bash and made the same change anyway. A block on one tool does not prove the action is blocked.
- [You cloned a repository. Your agent trusted it. Now what?](https://bluebear.io/blog/agent-trust-boundary/) — 2026-09-09 · A repository can ship its own agent configuration. Trust a parent folder once, and a cloned repo can redirect your coding agent's traffic to an attacker-controlled endpoint on the first question you ask.
- [Agentic Control for Software Engineers](https://bluebear.io/blog/agentic-control-for-software-engineers/) — 2026-07-16 · An enterprise-grade control layer on top of coding agents, keeping engineers in control without giving up the speed of auto-approval.
- [SaaS is dead. But not because AI "killed" it, because AI killed it.](https://bluebear.io/blog/saas-is-dead/) — 2026-07-16 · SaaS is dead, and vibe coding killed it from within. Why today's coding agents are built for vibe coders, not the software engineers who actually pay for them.
- [Who is profiling whom: what attackers fear about AI correlation](https://bluebear.io/blog/who-is-profiling-whom/) — 2026-07-15 · A Russian-language cybercrime thread shows attackers fragmenting malicious work across models and accounts to slip past per-request AI controls — and fearing the one thing that defeats it: correlation across behavior, identity, and context.
- [Angry Bear: Enforcing the Skills Your Coding Agent Keeps Forgetting](https://bluebear.io/blog/introducing-angry-bear/) — 2026-07-14 · Angry Bear is Bluebear's open-source pre-tool-use hook that blocks AI coding agents from editing files until the required skills are loaded, turning 'please follow the conventions' into a precondition. MIT, works with Claude Code and Cursor.
- [Bear Metal: The Coding Agent We Point at Our Own Backlog](https://bluebear.io/blog/introducing-bear-metal/) — 2026-07-07 · Bear Metal is Bluebear's open-source background coding agent: it works tickets delegated through Linear and opens pull requests through your GitHub App installation.
- [The mandate gap: the agent risk your security stack can't see](https://bluebear.io/blog/the-mandate-gap/) — 2026-07-06 · Coding agents introduce a new class of risk: the gap between what a user authorized and what the agent actually did. Why your existing controls miss it, and how to govern intent instead of just actions.
- [The Missing Dependencies Hidden Inside AI Agent Skills and Plugins](https://bluebear.io/blog/agent-skills-plugins-slopsquatting/) — 2026-06-08 · We found 72 exported AI agent skills and plugins referencing package names that do not exist, creating an opening for slopsquatting attacks across npm, PyPI, and Cargo.
- [Baloo: The Code Reviewer We Built for Our Own Agents](https://bluebear.io/blog/introducing-baloo-bear/) — 2026-05-28 · Baloo is Bluebear's open-source GitHub App for self-hosted AI pull request review, built from the agent we used to review our own agent-generated code.
- [The Hidden Git Branch That Leaked 20,000+ AI Coding Sessions](https://bluebear.io/blog/hidden-git-branch-leaking-secrets/) — 2026-05-19 · While tracing the source of an AI coding-agent dataset, we found 20,000+ agent sessions exposed through public Git branches, including API keys, credentials, infrastructure details, and screenshots.
- [It's Not What the Model Writes. It's What the Agent Runs.](https://bluebear.io/blog/not-what-model-writes-what-agent-runs/) — 2026-04-29 · Recent threat intelligence details how cybercriminals are using headless coding agent frameworks on compromised hosts to automate source code exfiltration.
- [The Hidden Attack Surface Inside Every Coding Agent](https://bluebear.io/blog/hidden-attack-surface-coding-agents/) — 2026-04-20 · Most teams still talk about coding agents as if they're just LLMs that write code. That misses the real security picture.
- [The Credentials Your AI Agent Sees (And Why You Should Care)](https://bluebear.io/blog/credentials-your-ai-agent-sees/) — 2026-03-20 · AI agents increasingly need credentials to act on our behalf, and by doing that are quietly turning local configuration files and shell profiles into a secondary, high‑risk credential store. That creates a new security boundary, a phenomena we call context‑window credential drift
- [The Coding Agent Ecosystem Is Now a Target](https://bluebear.io/blog/coding-agent-ecosystem-under-attack/) — 2026-03-11 · Attackers aren't just targeting what coding agents do — they're going after the entire ecosystem around them. InstallFix is only the latest example.