Today's briefing examines a critical development in AI security where researchers at Mozilla's 0DIN platform discovered that 'clean' GitHub repositories can trick AI coding agents, specifically Claude Code, into executing malicious payloads via DNS TXT records. We also analyze the massive data breach at Japanese telecom giant KDDI Corporation, which has potentially exposed up to 14.2 million email logins across six internet service providers due to a vulnerability in third-party software. Additionally, the episode covers a sophisticated phishing campaign in India using fake tax notices to deliver Remote Access Trojans and the U.S. Justice Department's seizure of nearly 400 illegal World Cup streaming domains under Operation Offsides. These incidents underscore a shift toward exploiting the automated trust in developer tools and the persistent risks inherent in the software supply chain, requiring practitioners to re-evaluate monitoring for dynamic execution chains and third-party dependencies.