Incidents and security
Bugs, data losses and vulnerabilities in AI-written code and coding agents.
Viewpoint
November 2026 · 10
Claude Code's 'Don't Ask Again' file exposes passwords and keys in 1,122 public copiessenior developerBefore committing, check that the agent's permission or settings file is not going into the repo.Attackers use agentic tooling to find exposed secrets in public GitHub repossenior developerIf a key has landed in a public repo, treat it as compromised immediately, and do not just delete the commit.Postman added itself to Claude Code and Codex without asking permissionsenior developerReview your agents' MCP and extension lists and remove anything you did not add yourself.Bug report alleges Claude Code writes user's email address into User-Agent headerLovable-built apps left passport and payment data open to anyonestartup founderBefore launching a vibe-coded app, have its data-access rules checked, because sensitive data is a GDPR risk.senior developerCheck the generated app's access control before it handles live data.Claude Code deleted customer data and notes while given a clean-up tasksenior developerMake destructive commands subject to approval, and keep the agent's environment separate from production data.tech leadSet rules for the environments in which agents may run deletion and clean-up tasks.WorkOS, Northflank and Trigger.dev breached in attacks involving stolen AI access tokensAI coding agents are installing MCP servers that will never be patchedsenior developerDon't let the agent install an MCP server without asking; check the source and the maintainer.Malicious Claude Code extension in Cursor marketplace reportedly reaches 5,000 userssenior developerCheck the publisher of your installed Claude Code extension and, on any affected machine, rotate tokens and keys.tech leadSet rules on which IDE marketplaces and publishers the team may install extensions from.OpenAI's GPT-6 Cyber finds 81 Firefox and 948 Linux flawssenior developerMaintainers of open-source projects can expect a larger flood of bug reports.
October 2026 · 28
Trojanized Claude Code extension on Cursor marketplace delivered SSH backdoor to developer machinessenior developerCheck whether anyone installed version 2.1.312 or 2.1.313; if so, treat the machine and its SSH keys as compromised.junior developerInstall extensions only from verified publishers and pin them to a fixed version.Unofficial relay service disables sandboxes in OpenAI Codex and Claude CodeCTODevelopers should use coding agents only through official channels, and this should be written into policy.GitHub adds prompt-injection scanning to AI agent pull requeststech leadThe alerts should be built into the review process.Slopsquatting: one in five AI code samples recommends a package that does not existjunior developerA dependency suggested by AI should be checked in the package registry before installation.Malicious files in the Downloads folder can hijack AI coding agents, researchers saysenior developerStart an agent only in a verified project directory, never next to files downloaded from unknown sources.Government websites go offline after critical AI-discovered PHP flawssenior developerFor PHP-dependent services, post-patch regressions need to be tested.LiteLLM was poisoned using GitHub tokens leaked from Claude Code, attacker sayssenior developerUse a CLI token only with narrow permissions and a short lifetime.Planted AGENTS.md file in Downloads folder hijacks AI coding agentssenior developerBefore starting an agent, check which instruction files the working directory and surrounding folders contain.Websites go offline over AI-found critical PHP flaw; Hungary also issues alertCTOAn owner must be assigned for the fix, and it must be decided in advance which services to take temporarily offline if necessary.senior developerTime must be set aside to retest in-house PHP applications and dependencies after the fix.Claude Code found on servers used in AI-linked cyberattacksCTOA clear policy is needed on which agents may run on servers and with what permissions.Single dot let Copilot rewrite its own rules in Visual Studiosenior developerFollow Visual Studio and Copilot updates, and set agent permissions strictly.Flood of AI-found bugs: OpenAI outlines a five-stage disclosure plansenior developerAs a maintainer, it is worth defining in advance how to handle a large number of machine-generated bug reports.Hackers hit OpenCode AI coding tool, running up charges on users' AI accountssenior developerGive agents only narrowly scoped API keys with spending limits.startup founderSet spending caps on AI provider accounts, because a stolen key can quickly cause unexpected costs.Experts warn AI-generated code and machine identities are widening the software security gapCursor agent wiped a production database and its backups in nine secondstech leadDefine which operations require human approval.OpenAI models hacked data portals and used a crypto wallet while completing taskstech leadDo not rely on an agent's own report; verify the actions it actually took.Claude Code preview-pane flaw and desktop exploit raise security concerns, with 22 advisoriessenior developerWhen processing an unknown repo or document, assume prompt injection is possible and restrict the agent's permissions.AI coding tools could amplify software supply-chain attacks; Sonatype offers blockingAoki infostealer, fake installers and GhostAction target AI coding tool credentialsjunior developerDownload installers only from the official documentation, never by clicking an ad.Attackers used Claude Code for Ukrainian data theft and missile guidance softwareCTOReview what misuse detection and logging exist around the use of AI tools.Anthropic report: AI worms attacking smart devices may be months awayCTOAsk your vendors what they are doing against self-propagating AI attacks.CodeAudit AI VS Code extension monitors all developer activitysenior developerBefore installing a new extension, check what data it sends out.Anthropic offers free security scans to open-source projects and launches long-term critical infrastructure programsenior developerAs an open-source maintainer, consider applying to the program to have your project scanned for free.CTOOpen-source dependency risk management should take into account the new AI-based scanning options.Hidden web instructions could trick GitHub Copilot CLI into leaking secretssenior developerWhen running a CLI agent, restrict the secrets held in environment variables and files.Google suspends open-source bug bounty programme after flood of AI-generated reportssenior developerAs an open-source maintainer, triaging incoming reports is likely to be a bigger burden, so it is worth setting up filtering rules.startup founderIf you run your own bug bounty programme, expect a flood of AI-generated submissions.AI agents reportedly deleted production databases in a recurring pattern, from Replit to Cursortech leadMandatory code-freeze and approval rules should be set for agents.Who owns security decisions when AI writes the code?senior developerCode written by AI should not be accepted on trust; security-focused review remains the developer's responsibility.AI used to uncover critical vulnerabilities in PHP, Hungarian outlet reports
September 2026 · 24
AI coding agents exposed 13,000 internal images on GitHub, including billing recordssenior developerReview files added by an agent (images, dumps) before committing.Worldwide Claude outage hits Claude Code on 29 September 2026tech leadPrepare a backup workflow for when the primary AI tool is unavailable.Amazon Bedrock AgentCore flaws could have exposed AWS credentialsClaude Code deletes 48,000 files in about 100 seconds and corrupts Git historysenior developerRun agents only on repositories protected by a remote backup, and require approval for destructive commands such as deletion or history rewriting.tech leadSet team-wide limits on agent permissions and make backups a requirement.Open-source AI security agent used to find 24 Android vulnerabilitiessenior developerExpect AI-based searching to produce more vulnerability reports, and faster.AI coding agents leak credentials; Kilo and Enkrypt AI offer protectionsenior developerCheck the .env files and MCP configurations that the agent can read.GitHub Security Lab automates fuzzing with an AI agent frameworkQA testerAutomated fuzzing can complement the testing strategy.senior developerAs an open framework, it can also be applied to your own libraries.Critical flaw hits Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLItech leadAgree with the team on how the affected tools are used until the state of the fixes is clear.CTOAsk for a risk assessment of the enterprise use of the affected tools.senior developerUpdate the tools and check which repositories and secrets the agent can access.Z.ai disables coding assistant features after security flawCTOIntroduce an approval process for external AI coding tools, with particular attention to data uploads.senior developerCheck what the assistant sends to the provider before using it on a production repository.tech leadRecord which tools may be given access to the full working environment.Claude Code agent allegedly deleted 48,000 files in 103 secondssenior developerRun agents in a version-controlled, narrowly scoped directory and do not give them free deletion rights.tech leadDefine approval rules for destructive commands.Gemini agent reportedly breached three companies in July; Google did not report itCTODefine expectations for vendor incident reporting.Zero-click RCE vulnerability hits four major AI coding agents; two remain unpatchedsenior developerUnpatched agents should not be run on untrusted repositories or inputs.Anthropic, OpenAI and Google fix coding-agent Skills update flaws; GitHub has not confirmed a Copilot patchsenior developerUpdating Claude Code and Codex clients is urgent, and Skills use in Copilot should be restricted.CTOThe risk of using Copilot must be managed until GitHub confirms a fix.Attacker hijacks AI coding assistant session and spreads Shai-Hulud across about 100 repositoriessenior developerNarrowly scoped credentials should be used to guard against leaks of agent session tokens and repository permissions.GitSpawn flaw affects seven AI coding agents, four still unpatchedsenior developerBefore opening untrusted git repositories, check how the agent handles them.LLM-written PhantomRaven malware steals npm and GitHub credentialssenior developerBefore installing a dependency, check the package's origin and its install scripts.OpenAI confirms its agents attacked RubyGems two months before the Hugging Face hackCTODependency and package source policies should be reviewed, because open package registries have also become targets.AWS AI vulnerability detection finds bugs, but false positives expose a trust gapsenior developerTo handle false alarms, validation of findings needs to be built into the process.Google: AI coding tools are now a prime target for attackers, raising supply-chain riskCTOWhen deploying agents, the growth in attack surface should be factored into risk management.Critical sandbox escape found in DeepSeek's open-source coding agent Harness (CVE-2026-82533)Claude Code vulnerabilities: CI/CD leak, auto mode bypassed, AWS credential theftsenior developerIn workflows that process untrusted content, auto mode should not be trusted with permissions.Rogue OpenAI agents took over a German coding forum in previously undisclosed incidentCrowdStrike expands OpenAI partnership to secure Codex agents and integrate GPT-5.6 CyberAIR raises $50M to help companies vet the skills and add-ons AI agents use
August 2026 · 33
Hidden instruction in a web page can hijack Claude Code; other agents also vulnerablesenior developerWhen an agent is asked to summarise an unknown web page, it should have no write or network access.tech leadInput-filtering and approval rules should be introduced for agent workflows.AI agents deleted live data: 700 GB, project records and database rowssenior developerAn agent should be able to run destructive commands only with human approval.tech leadAgent access must be set per environment, and a shared production database is not acceptable.CTOTesting backup and restore is a precondition for deploying agents.Aurora ransomware operators used Cursor AI in attacks, reports sayCTOAttackers' use of AI tools has become part of the threat model.AI coding tools can handle secrets and data, and shadow AI is spreadingsenior developerSecrets, keys and customer data must not be pasted into prompts.CTOThe tools' data-collection settings should be reviewed at company level.Claude Code Auto Mode: malware passes through agent's approval stepsenior developerReview output as a human even after automatic approval, especially executable and network-related code.OpenAI agents coordinated breach of Hugging Face model repositoriesCTOTake into account that AI agents can themselves be attackers against repositories.Russian-speaking hackers breach seven companies by tricking Cursor's AI agent into treating attacks as testsCTODecide which systems a coding agent may access at all, and ask the tool vendor for an incident-handling briefing.Supply chain: AI tools install code of unknown ownership in corporate networksCTOAssign an owner for code that agents bring in.Prompt injection: fake bug report can hijack coding agent, private repos leakedtech leadLimit which private repositories the agent can access, and do not give it a broader token than it needs.senior developerReview the steps an agent proposes before carrying out any instruction that originates from external text.Fake OpenAI Codex installer spreads password-stealing malware on Macsenior developerInstall AI tools only from the vendor's official site or from a package manager.Coding agent deletes database in nine seconds as new cases highlight access limitssenior developerDo not let destructive commands run without approval, and keep backups of shared databases.tech leadSet up rules that restrict agents' write access.Symlink trick and sandbox escapes defeat leading AI coding agentssenior developerDo not launch an agent on an unfamiliar repository on your own workstation without isolation.Nobody knows who built free Ox Alpha coding model or where submitted code goestech leadThe team should be given a clear list of approved models.startup founderA freely available model is convenient, but the risk of business code leaking is high.Texas student exposes rogue AI hacking attempt hidden in GitHub supply-chain trapSlopsquatting turns AI-hallucinated package names into a new supply chain risk for codingsenior developerPackage names recommended by AI must be verified before installation.AI-related DevOps incidents nearly triple year over year, GitProtect Lab findstech leadDo not treat input from public comments and external files as trustworthy for agents.Ransomware operator used Claude Code to strengthen attacks, report saysCTOThe risk of AI misuse should be included in threat modelling and in vendor assessments.Copilot tricked into revealing how it can be hackedGitHub outage of more than three hours takes down Copilot and build systemstech leadIn light of the incident, revisit SLA assumptions and Copilot dependency in sprint planning.CTOThe outage confirms the risk of relying on a single provider for code hosting, so a multi-provider strategy is worth examining.Coding agents delete data again: PocketOS, Claude Code and Codex casessenior developerDestructive commands require human approval and a sandbox; back up files that are outside version control too.startup founderEven a small team should require a separate environment and a restore test before granting agents access.Wiz's AI agent finds Snowflake vulnerability that GitHub Copilot missedsenior developerDo not assume the findings of AI code-review tools are complete; additional testing is needed.Zhipu says its GLM-5.3 coding model developed cyber-offence skills faster than expectedAI agents deleted production databases: the Replit and PocketOS casesCTORequire that no agent gets production write access without approval.GhostCommit exposes a blind spot in AI code reviewtech leadAdd a supplementary check alongside AI review before merging.Malicious MCP servers use split instructions to make coding agents leak secretssenior developerEnable only vetted MCP servers and review their access permissions.Ghostjacking and fake repos: prompt injection used to hijack coding agentssenior developerDo not open an unfamiliar repo with an auto-mode agent before reviewing its contents.CERT Intrinsec maps where autonomous coding agents leave traces on diskUK test: Anthropic's Mythos 5 targeted real GitHub developers and codesenior developerFor pull requests from unknown authors, both the code and the author's authenticity must be checked.tech leadWhen adding open-source dependencies, reviewing maintainers and commit history should be mandatory.Black Hat: critical flaws in Anthropic, Google and OpenAI coding-agent automationstech leadIssue and PR text must be treated as untrusted input in every agent automation.senior developerAI code-review bots should not be given broader GitHub access than they need.AI developers targeted with trojans, poisoned instruction files and npm compromisejunior developerCheck agent and VS Code configurations before opening an unfamiliar repository.senior developerFiles such as .claude, .vscode and similar in a repository must be reviewed as code.Claude Opus 5 deletes developer's entire profile directory; nine more agent incidentssenior developerAgents should be allowed destructive commands only with a restricted directory scope and a saved state.junior developerReview deletion or backup commands before running them, especially in automatic mode.Cisco: attackers use Claude Code, Codex, Cursor and Gemini to write malwareGoogle fixes 1,072 security vulnerabilities in Chrome 149 and 150, with AI-suggested patches