Maple Grove Report

Maple Grove Report

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.


Hybrid SUVs have become the default recommendation for anyone looking to save money at the pump. With more automakers embracing electrification, buyers are being told that adding a battery is the only way to achieve impressive fuel economy. While hybrids undoubtedly deliver excellent efficiency, they also tend to carry a higher purchase price.

That upfront premium means fuel savings don’t always materialize immediately. Depending on how much you drive, it can take years before the lower running costs offset the extra money spent at the dealership. For some buyers, that makes traditional gasoline-powered models a much more attractive proposition.

Fortunately, a handful of modern SUVs prove that you don’t necessarily need a hybrid powertrain to keep fuel bills in check. Thanks to efficient engines and clever engineering, these SUVs deliver economy figures that come surprisingly close to their electrified rivals, all while avoiding the additional complexity and cost that often come with hybrid ownership.

In order to give you the most up-to-date and accurate information possible, the data used to compile this article was sourced from various manufacturer websites, including the EPA.


Side profile shot of a green 2026 Nissan Rogue.


Forget a hybrid SUV—this one gets 32 MPG without a battery

A hybrid isn’t the only way to save at the pump—this SUV delivers an impressive 32 MPG without a battery or charging cable.

The Toyota Corolla Cross and Nissan Rogue tie in efficiency

Two non-hybrid SUVs that sip fuel anyway

Hybrids have definitely begun taking over the mainstream, with more and more options coming with electrified powertrains. While there is no doubting the fact that hybrids are exceptionally light on fuel, they cost you more money up front, meaning that it takes time for the fuel savings to really kick in. If you’re looking to save yourself some money up front, there are two Japanese SUVs that are so efficient that you’d hardly even notice that they weren’t hybrids.

Toyota Corolla Cross vs. Nissan Rogue efficiency

Model

City

Highway

Combined

Toyota Corolla Cross

31

33

32

Nissan Rogue

29

36

32

If you’re looking to skip the hybrid markup, then the Toyota Corolla Cross and the Nissan Rogue are the most efficient options out there. Strangely, they don’t compete in the same class. While the Corolla Cross is a subcompact SUV, the Nissan Rogue is more similar in size to the Toyota RAV4. Despite this, its thrifty little three-cylinder engine sips fuel nonetheless.

While both vehicles get the same combined efficiency rating, they both get there in different ways. The Corolla Cross is more of an urban crawler, getting better efficiency in the city. Its smaller stature also means it’s a little easier to maneuver. Meanwhile, the Nissan Rogue is stronger on longer journeys, with the EPA estimating that it gets up to 36 miles per gallon on the highway. Its larger size also makes it feel sturdier and more planted at higher speeds.

Below, we’ll dive into which one of these two fuel-sipping crossovers makes the most sense for you.


Front 3/4 shot of a 2026 Toyota RAV4 PHEV GR Sport


The Toyota RAV4 is finally vulnerable, and these 5 SUVs are after its crown

Five SUVs that are making life difficult for the class favorite.

The Corolla Cross is a cheap and cheerful crossover that keeps things simple

An SUV that is easy on your bank account

As the name implies, the Corolla Cross is simply a Corolla hatchback with more space on the inside. It follows the same ideology as its smaller sibling, with a simple and easy-to-use setup on the inside and a smooth, albeit unexciting, driving experience. Compared to the Rogue, this is the much cheaper option, so if you’re on a tighter budget, this is the way to go.

2026 Corolla Cross trims and pricing

Model

Starting MSRP

L

$25,235

LE

$27,565

XLE

$30,160

In the realms of subcompact SUVs, the Corolla Cross feels like the easy choice. You know that when you buy a product from Toyota you get an unspoken peace of mind, with the brand having such a strong reputation for reliability. It isn’t the most expensive option in its segment, but it isn’t the cheapest either. Its long list of standard tech and safety features, though, really make a strong case for the Japanese crossover.


2026-toyota-corolla-cross-hybrid-xse-exterior-1.jpg

toyota-logo.jpeg

Base Trim Engine

2.0L Inline 4

Base Trim Transmission

CVT

Base Trim Drivetrain

Front-Wheel Drive

Base Trim Horsepower

169 HP @6600 RPM

Base Trim Torque

151 lb.-ft. @ 4400 RPM

Make

Toyota

Model

Corolla Cross

Segment

Subcompact SUV



It isn’t a particularly entertaining car to drive, with dull handling and a zero-to-60 time of 9.2 seconds, but sportiness isn’t what most buyers at this price point are looking for anyway. Its ride is really comfortable, though, and it’ll get you where you’re going without too many bumps or jolts.

The Corolla Cross is designed for someone looking for the same simplicity as the Corolla hatchback, but with a more practical interior.


Dynamic front 3/4 shot of a blue 2025 Kia Sorento Hybrid driving on a country road with snowcapped mountains in the background.


The family hybrid SUV more buyers should be paying attention to

This underrated hybrid packs three-row practicality, great fuel economy, and a sub-$50K price that deserves a closer look.

If you’re after a more spacious family hauler, the Nissan Rogue has you covered

It is also surprisingly plush on the inside

As we mentioned, the Rogue is a bit of a step up from Corolla Cross, at least as far as size is concerned. In terms of practicality, the Rogue is more comparable to Toyota’s RAV4, with plenty of space in the front and back seats as well as the cargo area. If you’re looking for something more spacious than the Corolla Cross and you have a bit more wiggle room in your budget, opting for the Rogue means that you don’t have to sacrifice fuel economy.

2026 Nissan Rogue trims and pricing

Model

Starting MSRP

S

$29,490

SV

$30,490

Dark Armor

$33,340

Rock Creek

$34,390

Platinum

$39,390

The Nissan Rogue is a little cheaper than some of its core competition, including the Toyota RAV4 and the Honda CR-V. It’s affordable price tag is one of the reasons why it is one of Nissan’s best sellers. What is particularly impressive here is that, as you climb the trim ladder you find that Nissan’s compact SUV is capable of some serious interior luxury. Just don’t let its rugged-looking exterior trick you into thinking it is an overlander.


2025-nissan-rogue-rock-creek-4-1-1.jpg

nissan-logo.jpeg

Base Trim Engine

VC-Turbo 1.5L ICE

Base Trim Transmission

2-speed CVT

Base Trim Drivetrain

Front-Wheel Drive

Base Trim Horsepower

201 HP @5600 RPM

Base Trim Torque

225 lb.-ft. @ 2800 RPM

Base Trim Fuel Economy (city/highway/combined)

30/37/33 MPG

Base Trim Battery Type

Lead acid battery

Make

Nissan

Model

Rogue



A big reason that the Rogue manages to stay so efficient despite its larger size is its little three-cylinder engine. Despite having one fewer cylinder than its rivals, the Japanese SUV still manages to put down a reasonable 201 horsepower. Like the Corolla Cross, its driving dynamics are exceptionally dull, but the ride quality here is class-above.

If you’re someone who needs more interior space and does more highway driving, the Rogue feels like a better deal than the more compact Corolla Cross.


These two SUVs show you don’t need to go hybrid to save money on gas

The EPA estimates that the average new vehicle in 2026 manages 28 miles per gallon combined. Both the Corolla Cross and the Nissan Rogue manage much more than that, showcasing that hybrids aren’t the only way to cut down on your gas bill. Because they don’t come equipped with hybrid powertrains, they’re also a lot cheaper to buy up front, meaning that you’re also saving money on your car payments.

There is this preconceived idea that the only sensible way to save money when buying a car is to go for a hybrid, but that simply isn’t the case. Crossovers like this make a strong case for themselves, with their value being extremely hard to ignore, even in the hybrid era.



Source link


TL;DR

A flaw in Anthropic’s Claude Code GitHub Action let attackers bypass permission checks via a fake bot account and use prompt injection to steal OIDC tokens, gaining write access to any vulnerable repository. Anthropic patched the vulnerability within four days of disclosure.

The attack starts with a GitHub issue. Not a sophisticated one. Just an issue opened by a bot account with a carefully worded body that looks like an error message. When Claude Code’s GitHub Action picks it up for triage, it follows the instructions hidden inside, reads the process’s environment variables, and writes them back into the issue for the attacker to collect.

Those variables contain the credentials needed to request an OIDC token, which can be exchanged for a Claude GitHub App installation token with full write access to the repository’s code, issues, and workflows. Aim the attack at Anthropic’s own claude-code-action repository, which ran the same vulnerable workflow, and you could poison the action that thousands of downstream projects pull.

Security researcher RyotaK of GMO Flatt Security reported the vulnerability to Anthropic in January. The company fixed the core bypass within four days, with additional hardening through the spring. The patches are in claude-code-action v1.0.94. Anthropic rated the issues 7.8 under CVSS v4.0 and paid a bounty of $4,800.

How the bypass worked

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Claude Code GitHub Actions gives Claude read and write access to a repository’s code, issues, pull requests, discussions, and workflow files by default. To limit who can trigger those capabilities, the action checks whether the actor has write access to the repository.

The check had a hole. It automatically trusted any actor whose name ended in [bot], on the assumption that GitHub Apps are trusted tools installed by administrators. But anyone can register a GitHub App, install it on a repository they control, and use its token to open an issue on any public repository. The action saw a bot name and let the content through. Agent mode lacked the additional human-actor verification that tag mode performed, leaving it fully exposed.

Once past the gate, the attacker uses indirect prompt injection, planting instructions inside content that Claude reads as data but executes as commands. RyotaK crafted an issue body disguised as an error recovery message. Claude “recovered” by running the commands buried inside, reading /proc/self/environ despite Claude Code’s built-in guards against that exact operation, and posting the values to the issue.

A second path, no bot required

RyotaK also identified a softer route that bypassed the bot trick entirely. Anthropic’s own example issue-triage workflow shipped with the setting allowed_non_write_users: “*”, which permits anyone to trigger the action. Anthropic’s documentation already flagged this as risky, but many repositories copied the example and inherited the configuration.

Worse, Claude was posting task summaries to the workflow run’s publicly visible summary panel, creating a ready-made exfiltration channel. A third variant targeted race conditions: edit a trusted user’s issue after the workflow fires but before Claude reads it, and the malicious payload rides in as trusted input.

Not theoretical

The same pattern, an AI issue triager combined with broad permissions and prompt injection, has already caused real damage. In February, a prompt-injected issue title against Cline’s claude-code-action triage workflow let attackers steal an npm publish token and push an unauthorised [email protected]. The rogue version force-installed a separate AI agent called OpenClaw on roughly 4,000 developer systems during an eight-hour window before being pulled.

An autonomous bot called HackerBot-Claw then spent late February probing GitHub Actions misconfigurations at Microsoft, Datadog, and CNCF projects. When it tried to prompt-inject a Claude-based reviewer through a poisoned config file, Claude caught it and refused. That is both reassuring and concerning: the model’s defences are inconsistent enough that the same class of attack sometimes succeeds and sometimes fails.

Fifty bypasses and counting

RyotaK says he has now reported approximately 50 separate ways to bypass Claude Code’s permission system and execute commands. The finding is part of a broader wave of supply chain attacks targeting AI-powered developer tools, from the poisoned VS Code extension that breached GitHub’s own repositories to malicious npm packages designed to harvest credentials from AI coding assistants.

The remediation is straightforward: update to claude-code-action v1.0.94 or later, audit any workflow that allows non-write users or bots to trigger Claude, strip unnecessary secrets from the environment, and remove tools and permissions that could be used for exfiltration.

The deeper problem is structural. Prompt injection remains unsolved. An AI agent with real tools and real tokens can be pushed as far as its permissions allow, and the permissions most organisations grant by default are far broader than the attack surface they are prepared to defend.



Source link

Recent Reviews