The Shell-Injection Bugs My Agents Wrote (and the Tests Passed)
Three real shell-injection vulnerabilities coding agents wrote, that automated tests passed, and that a senior human caught before merge — proof AI code needs adversarial review, not just green CI.