Narrative · ▲ at peak

The coding agent is the new attack surface

All narratives · 24 supporting stories · 0 from Hungary

„Coding agents run with broad permissions, automatically read instruction files, and spread via extensions. This has made them a critical and rapidly expanding attack surface for the software supply chain.”

Counter-narrative

Providers are patching quickly: Anthropic, OpenAI, and Google fixed Skills-update vulnerabilities. Security products stop certain attacks; for example, CrowdStrike blocked AWS credential theft. This implies risks are manageable with patches and controls. However, patches are not universal: GitHub has not confirmed a Copilot fix, and the GitSpawn bug and a zero-click RCE bug remain unpatched in four and two affected agents, respectively.

Carriers

Black Hat researchers (Novee), Google Threat Intelligence Group, Microsoft Threat Intelligence, Security trade press (The Hacker News, Cybernews), Cursor security advisory, GitProtect Lab, Socket, CrowdStrike

Analysis

The core of the narrative is that the agent runs with developer privileges while ingesting untrusted content: repositories, websites, AGENTS.md files, MCP servers. This combination is structurally exploitable. New attack classes appear almost weekly: prompt injection, symlink tricks, sandbox escapes, GitSpawn, Skills updates, Trojan extensions. This indicates flaws are not unique but stem from the operating model. GitSpawn researchers say focus is shifting from prompt injection to other attack surfaces. Security vendors and trade media have an interest in amplifying risk, while labs emphasize rapid fixes. The weak point is not evidence but quantifying impact, as most reports show vulnerabilities, not actual harm. Real cases are rising: according to GitProtect Lab, AI-related DevOps incidents have roughly tripled.

Evidence: strong — Supported by cross-vendor vulnerability demonstrations, vendor patches and threat intelligence reports (Google TIG, Microsoft TI). Real compromises have also occurred: the poisoning of LiteLLM with stolen GitHub tokens, the spread of Shai-Hulud across roughly 100 repos, the keyv npm compromise and the trojanised Cursor extension. In the first half of 2026, GitProtect Lab tracked 84 AI-related DevOps incidents. The 1122 public Claude Code files are a secrets exposure, not a confirmed compromise.

What's at stake: Whether the developer workstation and CI become the easiest point to take over in the corporate network.

Narrative sub-threads

The narrative splits into 5 branches; a story may belong to several branches, and some may not appear in the main narrative's list.

→ lasting · evidence: strong

Poisoned instruction files and hidden prompts

Coding agents ingest instruction files, websites, bug reports, and repository contents, sometimes automatically. With a single placed file or hidden text, an attacker can thus divert them, leak secrets or private repositories, or execute malicious code.

The attack does not exploit a code flaw in the tool, but rather the content read by the agent (AGENTS.md, Claude configuration, repository, website, issue), breaching the trust boundary on the input side.

10 stories · 0 of them Hungarian ▲ at peak · evidence: strong

Breached sandboxes and bypassed approvals

The sandbox, auto mode, and oversight layer of coding agents have proven bypassable multiple times. Examples included zero-click RCE, symlink tricks, and hiding hundreds of actions from the monitor. Consequently, broad permissions become a direct code execution risk.

The evidence here lies in the inherent vulnerabilities of agent tools: sandbox escapes (including CVE-2026-82533), unpatched bugs, and bypassing the auto-mode classifier, not the ingested content or distribution channels.

9 stories · 0 of them Hungarian ↗ rising · evidence: strong

Channel for extensions, skills, and MCP servers

Extension marketplaces have become a vector for malware, and the Skills update mechanism and MCP servers proved vulnerable. The most severe case was a Trojan Claude Code extension spreading on the Cursor marketplace, which reportedly reached 5000 users and attempted to install an SSH backdoor.

The actors here are operators of the extension and tool supply chain (marketplaces, registries, MCP servers), and the mechanism is deployment and updates, not one-off prompt manipulation.

8 stories · 0 of them Hungarian ↗ rising · evidence: strong

Hunting agent tokens and developer secrets

Coding agents' session data, logs, and configuration files expose authentication data and tokens. These are collected by targeted malware, fake installers, and agent-based attack tools, then used for further propagation.

The target here is secrets left on developer machines and in repositories (OAuth tokens, API keys, AI access). The evidence is mostly actual incidents and malware campaigns, not researcher demonstrations.

11 stories · 0 of them Hungarian → lasting · evidence: moderate

Fabricated packages and orphaned code

AI coding tools expand the supply chain attack surface at the package and dependency levels. They may suggest non-existent packages, and reports indicate they have injected code of unknown origin into corporate networks.

Here the agent's control is not taken over; rather, the components it suggests or installs contaminate the chain. The evidence consists of threat reports and measurements (USENIX, Google GTIG).

5 stories · 0 of them Hungarian

Sub-thread stories

Poisoned instruction files and hidden prompts

Carriers: Novee, Pillar Security, Brandefense, GitHub

Breached sandboxes and bypassed approvals

Carriers: Anthropic, OX Research, METR, Microsoft

Aug 24, 2026Symlink trick and sandbox escapes defeat leading AI coding agentssenior developerDo not launch an agent on an unfamiliar repository on your own workstation without isolation.Aug 28, 2026Claude Code Auto Mode: malware passes through agent's approval stepsenior developerReview output as a human even after automatic approval, especially executable and network-related code.Sep 7, 2026Claude Code vulnerabilities: CI/CD leak, auto mode bypassed, AWS credential theftsenior developerIn workflows that process untrusted content, auto mode should not be trusted with permissions.Sep 8, 2026Critical sandbox escape found in DeepSeek's open-source coding agent Harness (CVE-2026-82533)Sep 16, 2026GitSpawn flaw affects seven AI coding agents, four still unpatchedsenior developerBefore opening untrusted git repositories, check how the agent handles them.Sep 18, 2026Zero-click RCE vulnerability hits four major AI coding agents; two remain unpatchedsenior developerUnpatched agents should not be run on untrusted repositories or inputs.Sep 21, 2026Critical flaw hits Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLItech leadAgree with the team on how the affected tools are used until the state of the fixes is clear.CTOAsk for a risk assessment of the enterprise use of the affected tools.senior developerUpdate the tools and check which repositories and secrets the agent can access.Oct 20, 2026Single dot let Copilot rewrite its own rules in Visual Studiosenior developerFollow Visual Studio and Copilot updates, and set agent permissions strictly.Oct 26, 2026METR red team broke OpenAI's agent monitoring in three waysCTOSandboxing and logging protections for agents require complementary controls.

Channel for extensions, skills, and MCP servers

Carriers: Cursor, Arcade/Smithery, AIR, Postman

Aug 10, 2026Arcade acquires Smithery, the MCP server registry Aug 11, 2026Malicious MCP servers use split instructions to make coding agents leak secretssenior developerEnable only vetted MCP servers and review their access permissions.Sep 1, 2026AIR raises $50M to help companies vet the skills and add-ons AI agents use Sep 17, 2026Anthropic, OpenAI and Google fix coding-agent Skills update flaws; GitHub has not confirmed a Copilot patchsenior developerUpdating Claude Code and Codex clients is urgent, and Skills use in Copilot should be restricted.CTOThe risk of using Copilot must be managed until GitHub confirms a fix.Oct 29, 2026Trojanized Claude Code extension on Cursor marketplace delivered SSH backdoor to developer machinessenior developerCheck whether anyone installed version 2.1.312 or 2.1.313; if so, treat the machine and its SSH keys as compromised.junior developerInstall extensions only from verified publishers and pin them to a fixed version.Nov 2, 2026Malicious Claude Code extension in Cursor marketplace reportedly reaches 5,000 userssenior developerCheck the publisher of your installed Claude Code extension and, on any affected machine, rotate tokens and keys.tech leadSet rules on which IDE marketplaces and publishers the team may install extensions from.Nov 3, 2026AI coding agents are installing MCP servers that will never be patchedsenior developerDon't let the agent install an MCP server without asking; check the source and the maintainer.Nov 5, 2026Postman added itself to Claude Code and Codex without asking permissionsenior developerReview your agents' MCP and extension lists and remove anything you did not add yourself.

Hunting agent tokens and developer secrets

Carriers: CERT Intrinsec, Socket, Microsoft Threat Intelligence, LiteLLM

Aug 10, 2026CERT Intrinsec maps where autonomous coding agents leave traces on disk Aug 25, 2026Fake OpenAI Codex installer spreads password-stealing malware on Macsenior developerInstall AI tools only from the vendor's official site or from a package manager.Sep 15, 2026LLM-written PhantomRaven malware steals npm and GitHub credentialssenior developerBefore installing a dependency, check the package's origin and its install scripts.Sep 16, 2026Attacker hijacks AI coding assistant session and spreads Shai-Hulud across about 100 repositoriessenior developerNarrowly scoped credentials should be used to guard against leaks of agent session tokens and repository permissions.Sep 25, 2026AI coding agents leak credentials; Kilo and Enkrypt AI offer protectionsenior developerCheck the .env files and MCP configurations that the agent can read.Oct 12, 2026Aoki infostealer, fake installers and GhostAction target AI coding tool credentialsjunior developerDownload installers only from the official documentation, never by clicking an ad.Oct 19, 2026Hackers hit OpenCode AI coding tool, running up charges on users' AI accountssenior developerGive agents only narrowly scoped API keys with spending limits.startup founderSet spending caps on AI provider accounts, because a stolen key can quickly cause unexpected costs.Oct 26, 2026LiteLLM was poisoned using GitHub tokens leaked from Claude Code, attacker sayssenior developerUse a CLI token only with narrow permissions and a short lifetime.Nov 4, 2026WorkOS, Northflank and Trigger.dev breached in attacks involving stolen AI access tokens Nov 6, 2026Attackers use agentic tooling to find exposed secrets in public GitHub repossenior developerIf a key has landed in a public repo, treat it as compromised immediately, and do not just delete the commit.Nov 7, 2026Claude Code's 'Don't Ask Again' file exposes passwords and keys in 1,122 public copiessenior developerBefore committing, check that the agent's permission or settings file is not going into the repo.

Fabricated packages and orphaned code

Carriers: Google Threat Intelligence Group, USENIX Security, Sonatype

Aug 19, 2026Slopsquatting turns AI-hallucinated package names into a new supply chain risk for codingsenior developerPackage names recommended by AI must be verified before installation.Aug 25, 2026Supply chain: AI tools install code of unknown ownership in corporate networksCTOAssign an owner for code that agents bring in.Sep 8, 2026Google: AI coding tools are now a prime target for attackers, raising supply-chain riskCTOWhen deploying agents, the growth in attack surface should be factored into risk management.Oct 13, 2026AI coding tools could amplify software supply-chain attacks; Sonatype offers blocking Oct 27, 2026Slopsquatting: one in five AI code samples recommends a package that does not existjunior developerA dependency suggested by AI should be checked in the package registry before installation.

Google search interest

Hungary

Topic and search term	Weekly	Average
The coding agent is the new attack surfaceAI agent security	no measurable search	0
Poisoned instruction files and hidden promptsprompt injection	no measurable search	0
Breached sandboxes and bypassed approvalssandbox training		0.7
Channel for extensions, skills, and MCP serversmcp szerver		0.6
Hunting agent tokens and developer secretsAPI key theft		1
Fabricated packages and orphaned codesupply chain attack	no measurable search	0

World

Topic and search term	Weekly	Average
The coding agent is the new attack surfaceai agent security		14.3
Poisoned instruction files and hidden promptsprompt injection		18.7
Breached sandboxes and bypassed approvalssandbox escape		2
Channel for extensions, skills, and MCP serversmcp server security		1.5
Hunting agent tokens and developer secretstoken theft		0.5
Fabricated packages and orphaned codesoftware supply chain attack		0

Google Trends relative search index over the period studied, weekly average. A narrative and its sub-threads appear in a single comparison: 100 is the group's most-searched day, and the figures can only be compared within the group. The search term was chosen by machine analysis; it measures how much the term is searched, not how widespread the narrative is.

Who is affected and how

senior developer: Agents should not be run in the Downloads folder or unknown repositories. Extensions should only be installed from verified sources and in verified versions. Claude Code approval files ('Don't Ask Again') should not be committed to public repositories.
junior developer: Fake installers and trojan repos target developers using agents. Always install tools from official sources, not ads, and do not accept output suggesting non-existent packages without verification (slopsquatting).
tech lead: Agent permissions must be restricted according to the principle of least privilege. CI secrets must be separated from the agent runtime environment.
CTO: Coding agents must be treated as part of the supply chain. This requires an inventory of tools, an approved extension list, an enterprise sandbox, and token rotation, not individual developer decisions.

Hungary

No or minimal domestic trace in the period examined: no [HU]-marked story in the list, no data on agent-based compromise against a domestic company.

Weekly trend

Supporting stories per week

Turning points

Aug 4, 2026Black Hat: critical flaws in Anthropic, Google and OpenAI coding-agent automationsNovee demonstrated at Black Hat 2026 that automations built on coding agents by Anthropic, Google, and OpenAI are all exploitable. In Codex, for example, a writable instruction file grants persistent control over the next agent. The risk thus emerged as a cross-vendor problem.Sep 21, 2026Critical flaw hits Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLIA single critical bug simultaneously affected Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI, reported in 25 articles. Technical details of the bug are unknown from the available excerpt.Oct 29, 2026Trojanized Claude Code extension on Cursor marketplace delivered SSH backdoor to developer machinesAccording to a Cursor security advisory, the Anthropic.claude-code extension versions 2.1.312 and 2.1.313 were malicious on the Cursor VS Code marketplace and attempted to install a persistent SSH backdoor. Later reports (2026-11-02-01) state the extension reached 5,000 users. The attack thus reached the distribution chain of the tools.

Related narratives in the News magazine

Agents slipped out of control

Supporting stories

Aug 4, 2026Black Hat: critical flaws in Anthropic, Google and OpenAI coding-agent automationstech leadIssue and PR text must be treated as untrusted input in every agent automation.senior developerAI code-review bots should not be given broader GitHub access than they need.Aug 4, 2026AI developers targeted with trojans, poisoned instruction files and npm compromisejunior developerCheck agent and VS Code configurations before opening an unfamiliar repository.senior developerFiles such as .claude, .vscode and similar in a repository must be reviewed as code.Aug 10, 2026Ghostjacking and fake repos: prompt injection used to hijack coding agentssenior developerDo not open an unfamiliar repo with an auto-mode agent before reviewing its contents.Aug 11, 2026Malicious MCP servers use split instructions to make coding agents leak secretssenior developerEnable only vetted MCP servers and review their access permissions.Aug 18, 2026AI-related DevOps incidents nearly triple year over year, GitProtect Lab findstech leadDo not treat input from public comments and external files as trustworthy for agents.Aug 19, 2026Slopsquatting turns AI-hallucinated package names into a new supply chain risk for codingsenior developerPackage names recommended by AI must be verified before installation.Aug 24, 2026Symlink trick and sandbox escapes defeat leading AI coding agentssenior developerDo not launch an agent on an unfamiliar repository on your own workstation without isolation.Aug 25, 2026Supply chain: AI tools install code of unknown ownership in corporate networksCTOAssign an owner for code that agents bring in.Aug 28, 2026Claude Code Auto Mode: malware passes through agent's approval stepsenior developerReview output as a human even after automatic approval, especially executable and network-related code.Sep 7, 2026Claude Code vulnerabilities: CI/CD leak, auto mode bypassed, AWS credential theftsenior developerIn workflows that process untrusted content, auto mode should not be trusted with permissions.Sep 8, 2026Google: AI coding tools are now a prime target for attackers, raising supply-chain riskCTOWhen deploying agents, the growth in attack surface should be factored into risk management.Sep 16, 2026Attacker hijacks AI coding assistant session and spreads Shai-Hulud across about 100 repositoriessenior developerNarrowly scoped credentials should be used to guard against leaks of agent session tokens and repository permissions.Sep 16, 2026GitSpawn flaw affects seven AI coding agents, four still unpatchedsenior developerBefore opening untrusted git repositories, check how the agent handles them.Sep 17, 2026Anthropic, OpenAI and Google fix coding-agent Skills update flaws; GitHub has not confirmed a Copilot patchsenior developerUpdating Claude Code and Codex clients is urgent, and Skills use in Copilot should be restricted.CTOThe risk of using Copilot must be managed until GitHub confirms a fix.Sep 18, 2026Zero-click RCE vulnerability hits four major AI coding agents; two remain unpatchedsenior developerUnpatched agents should not be run on untrusted repositories or inputs.Sep 21, 2026Critical flaw hits Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLItech leadAgree with the team on how the affected tools are used until the state of the fixes is clear.CTOAsk for a risk assessment of the enterprise use of the affected tools.senior developerUpdate the tools and check which repositories and secrets the agent can access.Oct 6, 2026Hidden web instructions could trick GitHub Copilot CLI into leaking secretssenior developerWhen running a CLI agent, restrict the secrets held in environment variables and files.Oct 12, 2026Aoki infostealer, fake installers and GhostAction target AI coding tool credentialsjunior developerDownload installers only from the official documentation, never by clicking an ad.Oct 25, 2026Planted AGENTS.md file in Downloads folder hijacks AI coding agentssenior developerBefore starting an agent, check which instruction files the working directory and surrounding folders contain.Oct 26, 2026LiteLLM was poisoned using GitHub tokens leaked from Claude Code, attacker sayssenior developerUse a CLI token only with narrow permissions and a short lifetime.Oct 29, 2026Trojanized Claude Code extension on Cursor marketplace delivered SSH backdoor to developer machinessenior developerCheck whether anyone installed version 2.1.312 or 2.1.313; if so, treat the machine and its SSH keys as compromised.junior developerInstall extensions only from verified publishers and pin them to a fixed version.Nov 2, 2026Malicious Claude Code extension in Cursor marketplace reportedly reaches 5,000 userssenior developerCheck the publisher of your installed Claude Code extension and, on any affected machine, rotate tokens and keys.tech leadSet rules on which IDE marketplaces and publishers the team may install extensions from.Nov 6, 2026Attackers use agentic tooling to find exposed secrets in public GitHub repossenior developerIf a key has landed in a public repo, treat it as compromised immediately, and do not just delete the commit.Nov 7, 2026Claude Code's 'Don't Ask Again' file exposes passwords and keys in 1,122 public copiessenior developerBefore committing, check that the agent's permission or settings file is not going into the repo.

Machine analysis based on story titles and summaries, with a verification pass. The source of the facts is the article linked at each story.