🎯 AI Coding Agent Weaponized, 💰 Polymarket $3M Hack, 🌐 236K Scam Sites, 🏛️ NAIC Breach Impact

The weaponization of AI coding agents is the day's defining story. Mozilla's 0DIN team showed a clean GitHub repository delivering a reverse shell to Claude Code through three benign-looking steps: a standard pip install, a package that refuses to run, and an init command that fetches its payload from a DNS TXT record. AI coding agent attack has no vendor patch; every developer running AI assistants against untrusted repositories is currently an attack surface.

NAIC suspended investment risk designations after ShinyHunters exfiltrated 3.1 TB from its Oracle PeopleSoft systems through a zero-day, CVE-2026-17435. NAIC breach The suspension delays insurer solvency classifications that state regulators rely on across all 50 states, turning a data breach into regulatory-operational disruption. Polymarket lost about $3 million when injected frontend JavaScript tricked users into approving fraudulent transactions; backend security was irrelevant once the attacker owned the code users executed.

The Uni-App framework now powers 236,000 scam domains across fake exchanges and pig-butchering operations, an industrial-scale template economy built on a legitimate toolkit.

Watchlist: third-party frontend dependencies for injection, PeopleSoft patch status, and AI coding assistants that can be steered into running setup commands from repositories.