Oracle has mitigated CVE-2026-35273, but it has not publicly confirmed the vulnerability’s in-the-wild exploitation.
Microsoft's June 2026 VS Code update turns on Autopilot by default and adds background sending for agent sessions.