PortSwigger

A security researcher warns that coding models should be treated as executable code, as they can generate malicious tool calls that exfiltrate environment variables or introduce subtle vulnerabilities…