Top AI coding agent security resources — September 2026

Following Black Hat and DEF CON disclosures, AI coding agent security research kept landing on the same nerve: the agent trusts the wrong source, and nothing in the stack is positioned to notice. GhostJacking turned a WAF’s own block log into a delivery channel. The firewall does its job and records the attacker’s payload verbatim. An agent asked later to review blocked traffic executes it. Success against Claude Code ran at 90% on a configuration the vendor itself recommends.

The default GitHub Actions configurations that Anthropic, Google, and OpenAI publish for their own coding agents fell to a single unauthenticated issue, and all three ended in remote code execution. Google’s own advisory for the Gemini CLI finding rated it CVSS 10.0. The same shape turned up inside CI/CD on Google’s ADK repository, where an ungated triage agent can be induced to summon a maintainer-gated one, and a git flag walks straight past a shell denylist to reach service account keys.

Academic work put numbers on the skills interface: a 2,826-file adversarial benchmark exploited two enterprise agents in 95.5% and 71.6% of runs, while the agents flagged a safety problem in 1.99%. Defenders published too, with a seven-layer containment design for agents that hold shell access and the first walkthrough of OWASP’s new agent skill risk list.

Nine resources, grouped by topic. Last month’s edition covered six coding assistants failing the same symlink boundary; the agentic AI security hub collects the rest.

Statistics

Total resources: 9
Category breakdown:

AI coding agent security resources

Coding agent attack technique

GhostJacking attacks: half of the Fortune 500 run these tools. Getting blocked by the firewall was the way to take over their AI agents

Observability data is the injection vector. A request the WAF blocks is logged with its payload intact, and an agent asked to investigate blocked traffic reads that log as instruction rather than evidence. The demonstrated chains reach DNS record modification, cloud credential theft, and cross-agent lateral movement where one agent’s trusted output drives another’s action, with 90% success against Claude Code on a vendor-recommended configuration and no standard detection firing anywhere along the way. Reconnaissance put more than 15,000 organizations in range.

Breaking Claude Code Opus 5 auto mode

The request is innocuous: summarize this URL. The server answers 415, the agent falls back to curl, and it pulls down an archive. Claude then does the safe thing and refuses the decoy binary inside, writing its own Python decoder instead. That rewrite is the exploit. Run from the extracted directory, import base64 resolves the attacker’s struct.py first by module shadowing, so the agent’s defensive substitution executes the payload it had just declined to run. Auto mode allowed the chain in 60% to 80% of runs, and the report was closed as “Informative” with no fix.

Prompt injection experiments with Opus 5, auto mode edition

The payload is in no file the agent reads as text. It is hidden steganographically in the repository’s only image, and it walks the agent through a puzzle chain ending in remote code execution under a sys.addaudithook() wrapper the agent builds for itself. The containment is the tell: addaudithook is an observability hook, and Python’s own documentation says it is not a sandbox. As in the finding above, the agent’s improvised mitigation reads as diligence while providing none, and it is the step that carries the payload.

Coding agent vulnerability

Black Hat 2026: if you run these automations, you’re exposed too: critical flaws in Anthropic, Google, and OpenAI’s coding agents

Three vendors, three default GitHub Actions configurations published on their own repositories, and one unauthenticated GitHub issue is enough to reach all of them. In Claude Code the bash validator stripped single-quoted content before inspecting it, so a git push --receive-pack=... flag read as empty and then executed, ending in remote code execution and theft of the API key and GitHub token after three rounds of patch and bypass. In the Gemini CLI the tool-restriction annotation was decorative and never enforced at runtime, and secret stripping fell to reading /proc/$PPID/environ in a shared PID namespace; Google rated it CVSS 10.0. In Codex, a two-pass workflow sharing one writable checkout let the first pass write a poisoned AGENTS.md that the second pass loaded as authoritative instructions.

I’ll just call you: agent-to-agent privilege boundary failures in CI/CD on Google’s ADK repository

Two agents in the same repository, one ungated and one maintainer-gated, and a prompt injection that bridges them. Content planted in a pull request reaches the low-privilege triage agent, which posts a comment that triggers the gated high-privilege workflow, inheriting a token with issues and pull request write scope and enabling comment impersonation and fake approvals. A second chain abuses a command denylist that blocks shell metacharacters but permits git, so git -c core.hooksPath=... and alias tricks yield arbitrary execution and expose API and service account keys. A different team found the same denylist-versus-git bypass against a different agent, in the research above.

Defense frameworks

OWASP Agentic Skills Top 10

The new OWASP Agentic Skills Top 10 is a risk framework for agent skills, which OWASP defines as reusable bundles of instructions, code, and resources that an agent can discover, load, and execute on its own. The list doesn’t prioritize by severity, so we address it in the next piece.

OWASP Agentic Skills Top 10 explained: the ten agent skill risks, and which to fix first

Adversa AI contributed to the OWASP list, then wrote this walkthrough of the ten risks, AST01 through AST10. It also carries original measurement: every open source skill scanner tested failed against encoded payloads while flagging between 9% and 62% of legitimate skills as malicious. Read alongside the malicious skill file benchmark below, it makes a blunt case that scanner selection is currently guesswork.

Coding agent defense

Secure agent harness execution: preventing escape

Seven independent control layers for agents that hold shell and tool access, each addressing a specific escape class rather than a generic hardening checklist. The stack runs from default-deny egress on isolated VLANs and disposable VMs through seccomp and AppArmor containers to kernel-enforced process confinement using Landlock on Linux and Seatbelt on macOS, plus JSON-RPC mediation of tool calls and a per-command policy engine that fails secure on escalation timeout. It names the escape classes it defends against: package publish, git push, unintended PR disclosure, SSH lateral movement. Those are exactly the ones the month’s attacks exercised.

Coding agent red teaming

Towards a risk assessment of malicious skill files in coding agents

The authors used six models to rewrite 471 real shell commands into skill files that read as benign, producing a released benchmark of 2,826 skills mapped to 11 MITRE ATT&CK tactics. Across 5,629 executions, Gemini CLI was exploitable in 95.5% of runs and Qwen Code in 71.6%, while the agent recognized a safety problem in only 1.99%. The evaluation pipeline is reusable on its own: run stratification, evidence anchoring, a refusal veto, and a three-judge panel validated against human review at Cohen’s kappa 0.85.

What to change before your next agent run

Start with the automation you copied from the vendor’s own documentation. Three of this month’s findings target published default configurations, and a fourth targets a repository maintained by the framework’s own authors. A configuration being official is not evidence that it is safe, and in August it was repeatedly the opposite.

Treat machine-generated text your agent reads as attacker-controlled, including the logs and alerts your own security tooling produces. GhostJacking and the ADK chain both work because a defensive artifact carries an offensive payload into a privileged context, and both were invisible to existing detection.

Audit the privilege gradient between agents that share a repository, a workspace, or a checkout. The gate a maintainer has to click is worthless if a lower-privilege agent can click it for them, and a writable working directory shared between two passes of the same workflow is an instruction channel.

Do not treat a clean skill scan as a result. The scanner bypass study and the 2,826-file benchmark point the same direction: current scanners miss encoded payloads and drown teams in false positives, so the useful control right now is execution isolation and credential scoping, not detection.

Every story here has the same shape. The attack is assembled from small pieces, each of which either looks benign or never gets inspected at all. The chain is the breach, and only by observing and reconstructing the whole chain of agentic actions can you stop the damage before it lands.