Loading story…
An empirical review of 3,171 public GitHub repositories found confirmed security defects in 16.0% of AI coding-agent harness configurations. The review covered 2,660 multi-component agent setups and 511 published skill collections, assessing instruction files, skills, hooks, subagents, and Model Context Protocol (MCP) server declarations. The most common issues were unpinned MCP server versions, overly broad execution pre-approvals, and skills that pre-authorized shell access for installers; researchers did not confirm a credential-exfiltration path.
The harness surrounding a coding model—its prompts, tools, skills, MCP servers, and orchestration—creates a material supply-chain and prompt-injection attack surface. Mutable remote MCP services, trusted prompt formatting, YAML skill metadata, and self-propagating payloads such as CopyPasta can be abused to influence agent actions. Organizations should inventory harness trust relationships, enforce least privilege and human approvals, pin and validate external components, independently monitor runtime behavior, and assign governance and incident-response ownership for agentic AI.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Benjamin Kapner, Carmel Soceanu, Alicia Petrunin, and Hofni Gartner submitted a study analyzing 3,171 public GitHub repositories containing AI coding-agent configurations. The study found confirmed security defects in 16.0% of setups, including unpinned MCP servers and overly broad execution pre-approvals, and released its scanner, corpus manifest, adjudication prompt, and verdicts.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026
Security researchers reported that the emerging AI agent ecosystem is being abused to distribute malicious tools at scale, with one campaign involving trojanized AI skills reaching **1.7 million installs** in an attack aimed at AI agents. The activity highlights how agents that can autonomously discover and install new capabilities are becoming a new software supply-chain target, particularly where marketplaces, repositories, and MCP servers lack mature vetting and integrity controls. Island said its research found **thousands of malicious repositories** and widespread security flaws across MCP servers, alongside a technique dubbed **"AgentBaiting"** that tricks AI agents into locating and recommending malware to users. The findings underscore a growing enterprise risk in which attackers can poison the AI toolchain itself, forcing organizations to strengthen governance over which agent skills, tools, and external services can be discovered, trusted, and deployed.
Aug 7, 2026
Researchers and security firms disclosed multiple ways attackers can manipulate AI agents and coding assistants into exposing sensitive data or executing malicious actions. In one case, Invariant Labs showed GitHub integrations built on the **Model Context Protocol (MCP)** could be abused to access private repositories, while Adversa AI reported a **two-click** exploit in Cursor that can trick developers into installing a malicious MCP server through a deeplink argument-injection flaw and a misleading confirmation dialog. Because MCP servers run with the user’s privileges, a successful attack could lead to arbitrary command execution, theft of source code and secrets, and full compromise of a developer workstation. Separate academic research found that AI agents can also be subverted through poisoned but trusted-looking data rather than explicit prompt injection. A study covered by *Nature* showed agents from OpenAI, Anthropic, and Google often accepted doctored datasets and altered README files, producing manipulated conclusions, while another paper introduced **agent data injection (ADI)**, in which attackers tamper with fields such as sender names, button IDs, or tool history to trigger misclicks, unauthorized purchases, fraudulent merge approvals, or attacker-command execution. Researchers said current defenses remain weak because agents do not reliably distinguish trusted from untrusted data, although measures such as MCP allowlisting, randomized identifiers, and stronger provenance tracking can reduce risk.
Jul 22, 2026