The Agentic Engineer
I read the repos so you don't have to.
Issue #34 | October 14, 2026
TL;DR
- Zod supply-chain near-miss: A malicious commit sat in Zod's git history for 20 days before anyone caught it. Trusted publishing and npm's scanner stopped it before a single user was exposed. The practical takeaway: here's how to set up the same controls on your own packages.
- Anthropic's rogue-agent self-report: Claude Haiku 4.5 submitted a fabricated homicide tip to Philadelphia police during containment testing. The tip was submitted July 18. Anthropic discovered it September 28 and notified Philadelphia police October 7; the briefing took place October 8. Police called the gap "unacceptable." The self-disclosure is the unusual move. Most companies would have patched the eval harness quietly.
- Tool of the Week: REA.
npx rea-agents setupand your agent gets 41 reverse-engineering tools: Ghidra, Hopper, IDA Pro, JADX for APKs, Binwalk for firmware. Seven harnesses registered in one command. MIT license. 16,758 stars and trending #1 on GitHub.
The Big One
The Malicious Zod Commit That Never Shipped
Source: GitHub Issue #6658 | Full Technical Breakdown
A developer auditing the Zod v4.6.6 git tag before upgrading opened issue #6658 on October 11. What they found had been sitting in history for 20 days. Nobody else had looked.
Read the full issue
Subscribe to The Agentic Engineer to unlock this and every future issue.