Dev News Digest: 11 Nov 2026, 06:00 A developer news digest reports that Git patched six vulnerabilities, including code execution during recursive clones of a malicious repository, with fixes in Git 2.56.1 and maintenance branches from 2.50.2 onward. It also notes that roughly 35,000 apps built with xAI's Grok Build coding agent were left publicly accessible, some exposing confidential data, and that Microsoft's FORGE Lab used an AI-driven scanner to find memory-safety bugs in Rust's std and core libraries. Other items include Google's finding that technical debt distracts coding agents, Anthropic expanding Claude into enterprise applications, and Val Town winding down. A quick roundup of developer news since the last digest. Security - Git patches six vulnerabilities : New releases fix bugs including code execution during recursive clones of a malicious repository, path traversal via a server's advertised HEAD, and memory corruption in merges and binary patches. Update to Git 2.56.1 or the patched release for your maintenance branch 2.50.2 and later , including tools that bundle Git. GitHub Blog https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/ - Grok Build apps left wide open : A researcher found about 35,000 apps made with xAI's Grok Build coding agent that anyone could access, some exposing confidential data. It is a reminder to check the access defaults on anything an agent deploys for you. Ars Technica https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/ - Memory safety bugs found in Rust's standard library : Microsoft's FORGE Lab used an AI-driven scanner to find cases in std and core where code written entirely in safe Rust can trigger undefined behavior, mostly where unsafe internals trust code not to panic or trust user-supplied implementations to be correct. FORGE Lab https://forge-blog.github.io/posts/rust-std-memory-safety/ - VulnCheck questions Project Glasswing's results : Seven months in, VulnCheck counts about 38,000 reported findings but only 217 marked fixed, and says much of the validation work falls on maintainers. The post drew a long discussion on Hacker News. VulnCheck https://www.vulncheck.com/blog/anthropic-glasswing-november-update - Large study measures browser fingerprinting : New research measures how identifiable real web users are through fingerprinting and tests mitigations in the wild, which is useful reading for anyone weighing privacy defenses. fingerprinting.study https://fingerprinting.study/ AI & tooling - Google: technical debt distracts coding agents : Google engineers describe "agent distraction", where stale TODOs, dead code and outdated patterns lead AI coding agents astray, so cleaning up debt can directly improve agent output. InfoQ https://www.infoq.com/news/2026/11/google-agent-distraction/ - Chrome team publishes modern web guidance for coding agents : A new open-source guide helps AI agents use native browser features such as