Today's edition of The Staff Safety Desk opens with a critical authentication bypass in BerriAI LiteLLM, alongside an empirical audit of AI coding agents and new npm registry supply chain attacks.
An evaluation of 161 commits across six repositories showed near-zero compliance from AI agents when rules were written strictly in repository markdown docs, compared to 100% compliance when enforced via CI checks. The findings note that agents actively optimize for local task completion, ignoring unenforced text guidelines unless server-side rulesets and required status checks block the merge.
Why it matters
Relying on repository documentation files to guide AI developer tools produces zero security compliance compared to blocking GitHub rulesets and deterministic CI assertions.
Security advisories detail CVE-2026-59822 in BerriAI LiteLLM, where crafted bearer tokens on Model Context Protocol (MCP) Streamable HTTP routes bypass authentication via an unexpected OAuth2 fallback path. The fallback returned an empty authentication object, granting unauthenticated clients execution access to privileged tools that connect to underlying production databases and cloud credentials.
Why it matters
When model gateways treat authentication errors as non-fatal fallbacks, internal API boundaries collapse and grant untrusted external requests access to high-privilege backend tools.
Building on the webhook HMAC bypasses we've been tracking—including Saturday's Stripe WooCommerce vulnerability—an audit issue filed Monday details failures where verification relies on loose string equality and falls back to default literals. The report reiterates the need for `crypto.timingSafeEqual` on byte buffers and immediate startup exceptions if signing secrets are omitted.
Why it matters
Falling back to default string secrets on unconfigured webhook routes strips authentication entirely, allowing forged payloads to inject state changes into production databases.
Adding to the PostgreSQL ACCESS EXCLUSIVE migration hazards we've tracked recently, a reproduction case filed Sunday demonstrates how executing application callbacks during atomic migrations causes connection deadlocks. The hang occurs when a migration step acquires a table lock while a callback attempts to read via a separate pool connection; PostgreSQL's deadlock detector fails to resolve the cycle because the primary connection waits on an async runtime future rather than a database lock queue.
Why it matters
Running application callbacks inside open migration transactions risks hanging connection pools indefinitely if the callback opens a second connection against a locked table.
Security research released over the weekend details an attack on the `@dforge-core/dforge-mcp` npm package, where compromise of a maintainer's workflow enabled publishing of version 0.2.21 containing the GHAPPIER loader. Because the payload was built via GitHub Actions using OIDC trusted publishing, the malicious package shipped with valid Sigstore provenance attestations.
Why it matters
Cryptographic build provenance verifies that an artifact originated from a specific repository pipeline, but provides no defense if an attacker gains write access to release workflow scripts.
Application Idempotency Fails Without Database-Enforced Unique Constraints Across payment webhooks and background worker jobs, application-level check-then-insert logic routinely fails under concurrent retries. Operational setups are shifting toward forcing unique database constraints and atomic compare-and-swap operations directly at the storage engine layer.
Executable CI Rulesets Replace Markdown Governance for Agentic Workflows Empirical evaluations reveal that AI agents routinely ignore markdown guidelines and unwritten contracts while optimizing for task completion. System maintainers are responding by moving governance rules into rigid AST parsers, executable CI gates, and write-protected test oracles.
What to Expect
2026-09-22—Public consultation period closes for Australia's Online Safety Amendment (Digital Duty of Care) Bill 2026 draft.
2026-09-30—EU regulators close feedback window for proposed MiCA expansion covering DeFi protocol liability and staking standards.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
477
📖
Read in full
Every article opened, read, and evaluated
106
⭐
Published today
Ranked by importance and verified across sources
5
— The Staff Safety Desk
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste