A scanner found, patched, and Google shipped: agents-cli 1.4.1 closes a credential-exfil hole
An automated scanner didn't stop at flagging a bug in google/agents-cli, it wrote the fix. The arbitrary file write in scaffold create could smuggle credentials out of an agent workspace, and Google merged the patch into v1.4.1. No CVE, no advisory, just a scanner closing the loop from finding to shipped patch. That is the scanner role evolving from reporter to fixer.