Vibe Coding Weekly — June 29, 2026

StepSecurity Exposes Malicious npm Agent Hooks

A massive npm supply chain attack just targeted AI coding assistants by injecting malicious hooks into config files during installation. Builders using autonomous agents should review this end-to-end security guide immediately to lock down their workspaces.

Skyvern Drops Browser MCP Server Guide

Browser automation is a massive superpower for coding agents, letting them visually QA and interact with the DOM directly. This fresh breakdown explores the top open-source browser MCPs available right now and how to configure them for your IDE.

18 Best AI Coding Agents Ranked by Agenticness

A deep, 36-point rubric evaluation of the current AI coding landscape, moving beyond simple autocomplete to measure true agent autonomy. If you are building an AI-assisted toolkit to accelerate your freelance gigs, this is your definitive buying guide.

Open-Source MCP Gateway and Registry Released

Managing permissions across dozens of MCP tools is getting messy, so the open-source community just shipped a unified control plane. It brings enterprise-grade OAuth and audit logs to your chaotic local agent environments.

Stratechery Details 10 Takeaways From Vibe Coding

Legendary tech analyst Ben Thompson breaks down his experience shipping a functional app entirely through prompt-driven AI workflows. His hands-on reflections capture exactly where the friction lies for solo builders today and how to overcome it.