Top AI coding agent security resources — November 2026

A trailing dot in a filename let Copilot in Visual Studio and SQL Server Management Studio write to its own MCP and settings files and reach command execution. A Claude Code session launched a child session inside a malicious repository, where a SessionStart hook ran without the confirmation the parent path would have required. GitHub Copilot CLI decrypted an attacker’s ciphertext in its own shell, trusted the plaintext, and sent local files to an attacker endpoint.

Microsoft patched the first. The other two went differently: Anthropic closed the child session report as Informative, and GitHub’s bug bounty team validated the Copilot CLI finding but declined to treat it as a vulnerability. A no consent RCE in opencode was fixed in a release that never mentioned security, and it has no CVE. A vulnerability scanner will show you little of what October produced.

Fourteen resources follow, grouped by topic. Last month’s edition covered git config hijacks in seven agents; the agentic AI security hub collects the rest.

Statistics

Total resources: 14

AI coding agent security resources

Attack technique

Beyond the model: backdoors in AI agent harnesses

In an isolated lab test with test credentials, a small change to local copies of legitimate agent extensions collected credentials and ran with the developer’s permissions on Pi and Anthropic’s Claude Code, firing only on the ordinary review phrase “lgtm, ship it”. The model was not involved, so tool permissions, approval prompts, and tool call inspection did not contain it: those controls govern the model, not code running alongside it. Any extension you install belongs in your supply chain review, and the hook in Session inception below shows the same blind spot from another direction.

Man-in-the-model: hijacking coding agents in transit

In proof of concept demos, a compromised gateway or proxy between the agent and its model injected tool calls the model never requested, and the interception layer can strip those calls from the conversation so the model never learns of them. Hermes in manual approval mode ran injected file edits and a Python script without a prompt, because it only prompts for commands it considers dangerous, while OpenAI’s Codex, with git as an approved prefix, ran a diff.external command that read a .env file. Rewriting a dependency name (“requests” to “reqiests”) is described as a plausible scenario rather than a tested one, and the relay incident below shows that third party infrastructure already sits in this position on real machines.

Markdown is the new executable: attackers are dropping agent instructions into your Downloads folder from the web

A web page can save a file into ~/Downloads with no click, and a malicious AGENTS.md disguised as engineering notes turned up in that folder on a real customer machine. Started in that folder, OpenAI Codex added a malicious MCP server to its machine wide ~/.codex/config.toml, running the malware in more than 90% of attempts, while Claude Code followed through about 50% of the time by setting ANTHROPIC_BASE_URL to an attacker endpoint, which also exposed its OAuth token. That redirect hands the attacker the same position the gateway demos in Man-in-the-model start from, so check both config files for entries you did not set.

Where you inject matters: the trust region effect in LLM agents

Agents trust parts of their environment unevenly: with the content held fixed, an agent powered by GPT-5.4 followed an unsafe instruction in a README or TODO file 2.6 times more often on average than the same text in a code or data file. Learning based attackers then improved on this by choosing placement as well as content. For anyone scanning repositories for injected instructions, documentation deserves at least as much attention as code, and the SolanaCry README below abuses exactly that kind of file.

Coding agent vulnerability

GitHub Copilot CLI vulnerability: cryptographic context injection steals developer secrets

One attacker controlled URL, fetched at the user’s request in autopilot, makes GitHub Copilot CLI decrypt a payload in its own shell, treat the plaintext as trusted, and send local files such as .env.prod to an attacker endpoint, including files outside the working directory. One model offered inside Copilot runs the chain, two others refuse it, the plaintext version is refused, and on Auto routing the user cannot see or control which model they get. The chain still reproduced on the affected model as of October 1, so detection has to link the agent’s actions rather than filter any single payload, a per action approach that Blocking at the boundary below tests formally.

Open and shut: remote code execution in opencode via MCP OAuth

A malicious remote MCP server returns an authorization_endpoint with a PowerShell subexpression inside a valid https URL, and opencode on Windows and WSL passes it unescaped to the open package’s PowerShell launcher, executing code during MCP OAuth with no user consent. No prompt injection is involved, so nothing at the model layer applies, and URL scheme validation fails because the URL is well formed. The fix shipped in 1.18.33 as a refactor with no CVE or advisory, because developer Anomaly treated a malicious MCP server as outside its threat model, which means scanners will not flag old versions and you have to inventory installs yourself.

Session inception: spawning a child Claude session to bypass parent guardrails

When a Claude Code session launches a new claude session inside a malicious repository, the child takes a different permission path, and in a proof of concept a SessionStart hook ran without confirmation and sent data from the Bash environment to an outside server. The parent’s guardrails worked as designed; the outcome simply arrived by a route where they never fired. Anthropic closed the report as Informative, treating trust in repository settings as part of the workspace trust decision, so review hooks in cloned repositories and watch for agents spawning CLI sessions through the shell.

Visual Studio Copilot and SSMS remote code execution (CVE-2026-103572)

The check meant to stop Copilot editing its own config misses .mcp.json., because Windows ignores the trailing dot and resolves it to the same file, allowing command execution that the report also demonstrated through indirect prompt injection. Microsoft rated it an Important severity RCE and patched it, which sets it apart from the Copilot CLI chain above. The flaw sits in a shared Copilot DLL that also affects SQL Server Management Studio and older versions including Visual Studio 2022, so patch beyond your primary IDE fleet.

Coding agent incident

Sandbox flipped to ‘danger-full-access’: unauthorized AI relays create risk for organizations

A relay service seen at a dozen organizations, most in mainland China, installs the genuine Codex and Claude Code CLIs through a fileless script, then disables the execution sandbox, enables network access for the write sandbox, swaps API credentials for relay tokens, and disables telemetry. There is no evidence so far that the operator has abused this access, but the configuration would let it read every prompt, file, and secret and run commands with the user’s full privileges. It is the real world version of the position Man-in-the-model demonstrates in the lab, and because the setup command looks like a normal companion step to an npm install, the place to catch it is the resulting config.

SolanaCry: agents searching the internet attacked by malware discovered in the wild, steals their crypto wallets

A fake GitHub repository, SolanaUpdateTools/solana-starter-kit, ranks as the top result when an agent searches for a Solana starter kit, and its only installation step is a fileless PowerShell one liner that installs a remote access trojan, exposing crypto wallets on the machine. The write-up reports no victim counts, and the payload URL returned 404 when checked, so the payload was recovered from a web archive. The delivery path is the lesson: the developer may never see the repository, so do not let agents run iwr | iex or curl | sh without review.

Defense frameworks

The secure software factory: a reference architecture

This draft architecture, open for comment since October 13, reduces agent security to one rule: the agent proposes, policy authorizes, infrastructure enforces. Four boundaries (sandbox, network, supply chain, identity and access) stay the same across three autonomy levels, and a worked example has a proxy blocking an incident agent from a second service’s logs until a new authorization decision grants access. It is a useful template for answering the backdoor and gateway findings above, since those attacks get past controls that depend on the agent or its own harness behaving.

Coding agent defense

Blocking at the boundary: auditing long-horizon agents against staged prompt injection

Confirmed attacks against Claude Code and OpenAI’s Codex in their native runtimes span eight workflow scenarios, seven attack goals, and six injection surfaces, carrying an injection across connected stages until it alters a consequential action. Path-Aligned Attribution, a training free auditor, traces what supplied each value in a pending action and blocks at 86% recall with a 6 to 8% false block rate, against 44 to 47% recall at 16 to 33% for ARGUS, under fail open scoring with Claude Sonnet 5 as the backend. Checking each action before it takes effect is the same placement the Copilot CLI write-up above argues for, and it matters more given how little INFUSE, below, found existing guard models help.

Coding agent red teaming

INFUSE: a unified surface benchmark for indirect prompt injection in agentic systems

Across 40 long horizon tasks, 56 attack scenarios, and 19 LLMs, mean attack success reaches 19.6% under LLM based evaluation and 15.4% under heuristic verification, with per model rates from 3.2% to 41.9%. Existing guard models provide limited protection, while prompt level hardening cut mean success from 58.2% to 14.3%, with security and utility trade-offs that depend on the model. That per model spread is the Copilot CLI model lottery in numbers, so any assessment of an agent has to name the model it ran on.

Article

Is Claude Code safe for the enterprise? What the official settings cover, and what they don’t

By Anthropic’s own documentation, managed settings bind Claude Code only, can be edited by a developer with local admin rights, and are not read by Anthropic hosted cloud sessions, while auto mode misses 17% of the risky actions in Anthropic’s test set and users approve 93% of permission prompts. Only two of the ten best documented attacks on Claude Code produced CVEs, which fits the pattern of reports like Session inception that never reach a scanner. The guide treats the settings as a floor and adds four controls that shrink reach (credentials the agent never holds, egress denied by default, isolation for unattended runs, config treated as code), plus monitoring of what every agent actually does.

Check agent configs and gateways on developer machines this week

Start with the items that have a clear fix. Upgrade opencode to 1.18.33 on Windows and WSL by inventorying hosts directly, since no CVE will prompt you, and apply the Copilot patch to SQL Server Management Studio as well as Visual Studio.

Next, look for changes you did not make: [mcp_servers.*] blocks in ~/.codex/config.toml, ANTHROPIC_BASE_URL in .claude/settings.json, disabled sandboxes, and relay tokens in place of your own API credentials. Stop starting agents in ~/Downloads, require review for download and execute commands, and alert when an agent spawns a new CLI session inside a cloned repository.

Then list every gateway and proxy your agents talk through and treat each as part of the trust boundary, because approvals and sandboxes cannot show that a tool call came from the model you meant to trust. Where you can, move enforcement to the network and identity layers outside the agent, since October’s backdoor, relay, and child session findings all got around controls that lived inside it.

Part of our AI coding agent security coverage: the category, its attack surface, and the research behind it.