{"author":{"username":"kazani","displayName":"Kazani","fid":4926},"timestamp":"2026-11-13T14:16:08.000Z","text":"AI agents are getting wallets, and a permission prompt is already lying to one.\n\nClaude Code's VS Code plugin shows a symlinked path as inside your workspace when it resolves outside it, so a prompt-injected agent could reach ~/.ssh. Reported unpatched as of v2.1.322 (UltraStrike). The CLI shows the real location.\nhttps://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/\n\nBrave Search API now takes x402 payments: no account, no API key, an agent pays $0.005 per request in USDC.\nhttps://brave.com/blog/search-api-agentic-payments/\n\nLibreAGI is a private torrent tracker for keeping copies of open models alive if their hosts vanish.\nhttps://libreagi.com/\n\nDaily reads like this: t.me/kazanireads","links":[{"url":"https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt","title":"Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt"},{"url":"https://brave.com/blog/search-api-agentic-payments","title":"The Brave Search API now accepts agentic payments via the x402 protocol | Brave"},{"url":"https://libreagi.com/","title":"LibreAGI"}],"farcaster":"https://farcaster.xyz/kazani/0xad249ae473f6aa4875e6c14ffe666db3789a77be","firefly":"https://firefly.social/post/farcaster/0xad249ae473f6aa4875e6c14ffe666db3789a77be"}