In code we trust? Why the most trusted software receives the least scrutiny.

A Sophos article that describes disciplined code-review habits—variant hunting, patch-gap reading, manual source review, and consistency checking—using examples including CVE-2026-54358 and several MCP-related CVEs; it warns that AI-agent integrations amplify the blast radius of authorization and trust-boundary bugs and recommends targeted review, consistent enforcement of security controls, and responsible disclosure.