Security

A research preprint demonstrates a computer worm that runs a local language model on hijacked machines and devises its attacks per target. What is new about the proof of concept, what is not, and why patch management alone is no longer enough.

The TeamPCP incident from May 2026 shows how a tampered VS Code extension led to the exfiltration of around 3,800 internal GitHub repositories — and why the problem is not GitHub but the trust model of modern developer environments.