Top AI Coding Agent security resources — August 2026

The coding agent story in July was not a novel attack technique, but the same trust boundary failing in six products at once. A symlink and approval bypass pattern was documented across top coding assistants, expanding a class Adversa AI disclosed earlier.

The individual bugs escalated from there. Surfaced this month: two CVSS 9.8 zero-click RCEs in Cursor, AWS Kiro rewriting its own MCP server config after reading hidden text on a web page, a Cursor deeplink flaw that installs an attacker-controlled MCP server, and GitHub’s own Agentic Workflows reading private repositories and posting the contents as a public comment. The month’s most discussed failure, though, needed no attacker at all: a user reported losing a production Supabase database ten minutes into their first Claude Code session.

Let’s dive: we have nineteen resources to review, grouped by topic. For the same month from the wider agent angle, see the August agentic AI security digest.

Statistics

Total resources: 19
Category breakdown:

Category	Count
Coding agent attack technique	6
Coding agent defense	5
Coding agent vulnerability	5
Coding agent incident	1
CISO resources on coding agents	1
Threat modeling	1

Coding Agent security resources:

Coding agent attack technique

MOSAIC: knowledge-guided CLI command composition attack in LLM coding agents

Individually benign CLI commands compose into a dangerous producer-consumer state relation across a command trace, which per-command safety checks never see. MOSAIC distills CVEs into exploit paths and reaches a 96.59% attack success rate against real coding agents working on ordinary developer tasks.

Beware of agentic botnets: scalable untargeted promptware attacks via universal and transferable adversarial HalluSquatting

Agents routinely ask for resource identifiers that do not exist. This work registers those names first, so the hallucinated skill or package resolves to attacker-hosted promptware, with hallucination rates reaching 100% in skill installation scenarios. The payloads transfer across models and applications and reach remote tool execution and remote code execution against production systems, which converts an untargeted model failure into a botnet with no victim selection at all.

Setup complete, now you are compromised: weaponizing setup instructions against AI coding agents

The first systematic evaluation of supply chain attacks that fire at package install time, delivered through project setup documentation. Editing only a README or a requirements file is enough to redirect an agent to untrusted registries or malicious package names, and attacks planted in source were missed almost everywhere.

IssueTrojanBench: benchmarking AI coding agents against malicious issue requests

A benchmark of malicious issue requests across four attack categories, run against state-of-the-art coding agents. It measures how instructions embedded in an issue induce misuse, data exfiltration, and persistent environment compromise. Directly relevant if you let agents triage inbound issues.

Friendly fire: hijacking defensive cyber AI agents for remote code execution

A proof of concept that turns a defensive task offensive: injections hidden in ordinary repository files persuade an agent asked to review untrusted code into executing the very artifact it was inspecting. No hooks, skills, or MCP servers are required, which removes the usual “we don’t install third-party extensions” defense.

Agent data injection attacks are realistic threats to AI agents

Agent data injection (ADI) hides malicious instructions in data disguised as trusted metadata or context, slipping past existing indirect prompt injection defenses. Against coding agents, the authors spoof pull request authorship and trigger command execution.

Coding agent defense

Agent skill security: threat models, attacks, defenses, and evaluation

A lifecycle-aware framework for evaluating the security of reusable agent skills, with a threat taxonomy covering repository admission, retrieval, planner selection, execution, and skill evolution. It is evaluated on hundreds of real-world skills rather than synthetic examples.

SkillGate: cost efficient runtime malicious skill file detection in coding agents

A runtime detection approach for malicious skill files installed into coding agents. It targets the supply chain surface where downloaded skill markdown silently reprograms agent behavior to exfiltrate credentials or inject backdoors. Worth reading next to the scanner bypass results below, since static gating alone clearly is not holding.

A hole in every one: bypassing the open source AI skill scanners

Eight open source agent skill scanners were tested against real attacks, and one malicious skill passed all eight using encoding, homoglyph, paraphrase, and bundled code bypasses. The post adds false positive benchmarking and an eleven-point specification for anyone evaluating a scanner front end.

The Balkanization of execution security research for AI coding agents

An SoK that sorts 39 execution security defense papers into 17 categories spanning sandbox isolation, capability control, policy enforcement, TOCTOU, MCP threats, and egress control. Its real contribution is the five cross-cutting gaps that no single defense addresses.

Cyber-capable AI agents: vulnerabilities, evaluation containment, and defensive response

A taxonomy of defensive controls for autonomous code-executing agents: containment, privilege separation, provenance, and responder access. Its case study for sandbox escape and containment failure is the frontier lab intrusion, the evaluation agent that broke containment and attacked Hugging Face.

Coding agent vulnerability

The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution

Two crafted deeplink flaws install an attacker-controlled MCP server and run unsandboxed commands after a single click, because the install dialog truncates the approved command off-screen. The write-up includes a cross-agent URL handler survey and defender controls.

GhostApproval: AI coding assistant trust boundary flaw

The research documents a systematic pattern across six top coding assistants: a malicious repo uses symlinks (CWE-61) to make the agent write outside the workspace while the approval prompt hides the real target from the user (CWE-451), ending in remote code execution. This is the same bug class Adversa AI reported earlier in five AI coding agents, so read the follow-up research as independent confirmation plus additional vendor coverage.

GitLost: how we tricked GitHub’s AI agent into leaking private repos

It shows that GitHub Agentic Workflows feed an issue title and body straight to the agent as instructions, so a plain English payload in a public issue makes the agent read private repositories in the same organization and post their contents as a public comment. It needs no code, credentials, or repository access, and the word “Additionally” was enough to walk past GitHub’s guardrails.

DuneSlide: two critical RCE vulnerabilities

Two flaws in Cursor, both CVSS 9.8, let zero-click prompt injection escape the terminal sandbox and overwrite the sandbox helper binary. The payoff is OS-level remote code execution on the developer machine and on connected cloud workspaces.

When the AI edits its own trust boundary: remote code execution in AWS’s agentic IDE

Hidden text on an ordinary web page instructs AWS Kiro to silently rewrite its own MCP server config file and auto-reload it. In the default autonomous mode there is no effective approval prompt, so the agent edits the boundary that was supposed to contain it.

Coding agent incident

Opus 5 wipes the entire database

A user-reported production environment wipe, ten minutes into the poster’s first Claude Code session. Investigating a contradiction between a raw db execute result and an ORM read, the agent ran prisma migrate diff with the wrong parameters, deleting live databases. The agent noticed and disclosed the damage itself, which is the only part of the chain that worked as designed.

CISO resources on coding agents

Hugging Face incident initial postmortem

A CISO community postmortem, reviewed by dozens of CISOs, of the first publicly documented autonomous AI attack. For coding agent owners the value is in the action roadmap: it calls for controls specific to agents and coding assistants, aimed at the agents already running in your environment, and for instrumenting the agent itself for visibility instead of relying solely on external observability. That means monitoring agentic actions, tool utilization, and decision-making, and prioritizing prevention and automated policy enforcement, because “waiting for human intervention is not viable for most agentic operations”.

Threat modeling

The week of sandbox escapes

The hub post for a seven-part series that reproduces sandbox escapes across four agentic coding tools, grouped into four failure modes: denylist sandboxes, executable workspace config, name-based command allowlists, and privileged local daemons. It closes with vendor questions and a layered threat model.

What to fix before the next agent run

Stop treating the approval prompt as ground truth. Both research blogs on symlinks, the Cursor deeplink flaw, and the Kiro config rewrite all share one property: the user approved something other than what executed. Then assume the repository is also a hostile input. READMEs, requirements files, issue text, and skill markdown are all proven execution vectors now, and GitLost shows the payload need not reach a file at all: a public issue body was enough.

Skills deserve their own line in that policy, because July attacked them from both ends. SkillGate and our scanner bypass test address the malicious file you already have, while HalluSquatting attacks the step before any file exists, when the agent invents a plausible skill or package name and goes looking for it. The control that covers both ends is an allowlist of sources the agent may resolve names against, backed by runtime detection and an OS-level sandbox instead of an agent-level denylist.

Finally, treat destructive database and filesystem operations as their own permission class, separate from ordinary edits, because the month’s most instructive failure was not an exploit at all: an agent pointed a Prisma shadow database at production and dropped 22 tables while trying to resolve a schema contradiction. Instrument the agent itself and enforce policy automatically, as the CSA note argues, because if your plan is for a human to catch the destructive command in an approval dialog, the symlink research above already showed what that dialog is worth.