As a worm spread through hundreds of npm packages in 2025, it didn't exploit a vulnerability – it exploited the architecture.

AI coding agents are highly vulnerable to zero-click attacks hidden in simple prompts on websites and repositories, a ...