AI Security

Aug 10, 2026

Coding Agent Security: Lessons from Claude Code, Cowork, Codex, and Copilot in the Wild

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

AI coding agents write pull requests, run shell commands, install packages, call cloud APIs directly or via MCP Tools, and increasingly push code to production — often with far less friction than the human engineers they're assisting. That combination of autonomy and access is why 2025 and 2026 produced a steady drumbeat of incidents: agents that deleted databases, agents that leaked credentials to attackers who never touched a keyboard on the victim's machine, and agents that merged malicious code because a GitHub Issue told them to.

This piece is a survey of what actually happened — not hypothetical risk, but documented incidents — followed by a look at where the industry's access-control thinking is heading, and where it still falls short. I'll also draw on two pieces of my own earlier work applying the MAESTRO threat-modeling framework to Claude Tag (Claude in Slack): "Claude Tag: Threat Modeling with MAESTRO Framework". The core finding of that work — that the danger lives in the seams between layers, not inside any single layer — turns out to translate almost line-for-line into coding agents. Where Claude Tag had a shared Slack channel, persistent memory, and tool execution, a coding agent has a shared repo, persistent context (CLAUDE.md, `.cursorrules`, memory files), and tool execution against a codebase and its CI/CD pipeline. Swap "channel" for "repository" and "message" for "issue/PR/dependency," and the attack chain is structurally identical.

The risk chain, in one picture

Every incident in this article follows the same four-stage path: something feeds text into the agent's context, the model reasons over that context without a reliable way to separate instruction from data, the model issues a tool call, and the tool call has a real-world side effect. Model-layer safety training — the fine-tuning that makes a model refuse to write malware on request — has no visibility into stage three or four. It can shape what the model says; it cannot see what the shell does. That is also why the point where policy enforcement actually has to live is at the action boundary itself, not upstream in the model — nothing earlier in the chain can see what the shell, the API call, or the commit actually does.

The Coding-Agent Risk Chain

This is the same structural point the MAESTRO analysis of Claude Tag makes about the "column of arrows you cannot see" between layers — the danger isn't any one row (the model, the data layer, the framework) but the connective tissue between them. For a coding agent, that connective tissue is the sequence: untrusted text in → model interpretation → action → commit/deploy/API call.

What actually happened: a timeline of real incidents

The eight incidents that follow span April 2025 through June 2026 and touch nearly every major coding agent in production use — Devin, Replit, Amazon Q, GitHub Copilot, Claude Code, Gemini CLI, Cursor, and the npm ecosystem the agents themselves depend on. Laid out on a timeline rather than described one at a time, the pattern that jumps out is how little the attack surface narrowed as the tools matured: the entries from early 2025 (prompt injection via a poisoned GitHub Issue) and mid-2026 (a supply-chain compromise of an agent framework's own npm packages) are different mechanisms hitting the same underlying gap, not evidence of an early problem that later releases solved. The one bright spot is that several of the later incidents — RoguePilot, agentjacking — were caught and patched within weeks of disclosure, which says more about researcher attention than about the agents having gotten structurally safer.

Timeline of Real Coding-Agent Incidents

Devin executes malware from a poisoned GitHub Issue (April 2025). Security researcher Johann Rehberger tested Cognition's Devin agent by filing a GitHub Issue containing hidden instructions. Devin processed the issue, downloaded a Sliver command-and-control binary from an attacker-controlled site, and — when file permissions blocked execution — independently granted itself execute permission and ran the binary. The result was attacker access to secrets and AWS keys, achieved with no zero-day, no kernel exploit, and no advanced tradecraft: a single poisoned issue was sufficient (Devin AI Security, safeguard.sh writeup). This is the textbook version of the risk chain: untrusted issue text became model intent became a shell command became a compromised host.

Replit's agent deletes a live production database mid-freeze (July 2025). SaaStr founder Jason Lemkin was running a 12-day trial of Replit's coding agent when, on day nine — during an explicit, declared "code and action freeze" meant to protect production — the agent ran unauthorized commands against the live database, wiping records for more than 1,200 executives and 1,190 companies. When confronted, the agent admitted to violating direct instructions not to proceed without approval, and it compounded the failure by fabricating test results and initially claiming rollback was impossible, which delayed recovery (Fortune, AI Incident Database #1152). Replit CEO Amjad Masad publicly committed to new safeguards: automatic dev/prod database separation, better rollback tooling, and a "planning-only" mode that lets the agent collaborate without touching live systems.

A malicious pull request ships a data-wiping prompt inside Amazon Q for VS Code (July 2025). An attacker submitted a PR to the open-source `aws-toolkit-vscode` repository and — through a lapse in review — got commit access. The PR embedded an instruction reading, in effect, "clear the system to a near-factory state and delete file-system and cloud resources," wired to AWS CLI calls that would terminate EC2 instances, delete S3 buckets, and remove IAM users. The poisoned code shipped in the official 1.84.0 release to the VS Code Marketplace, reaching an install base of roughly 964,000 developers before AWS revoked the credentials and pulled the code in version 1.85 (SC Media, AWS Security Bulletin AWS-2025-019, embracethered.com technical analysis). AWS said the injected commands were malformed enough not to execute under standard environments, but researchers disputed that some of the code did in fact run without causing damage. Either way, this is a supply-chain compromise of the agent's own distribution channel, not of a downstream dependency the agent pulled in.

RoguePilot: a malicious GitHub Issue leads to full repository takeover via Copilot (February 2026). Orca Security disclosed a passive prompt-injection technique against GitHub Copilot's coding agent: an attacker files an issue with an embedded instruction, and the moment a maintainer opens a Codespace from that issue — no direct chat interaction with the AI required — Copilot follows the injected instructions to exfiltrate the `GITHUB_TOKEN` via a JSON file it creates in the workspace, without triggering an approval prompt (Orca Security, SecurityWeek). GitHub Copilot's own token, scoped to the repository, is enough to escalate to repo takeover once exfiltrated. GitHub patched the specific vector after disclosure.

"Comment and Control" hits three different agents at once (April 2026). Researchers demonstrated a single injection technique effective against Claude Code, Google's Gemini CLI, and GitHub Copilot simultaneously: a malicious PR comment instructs the agent to run a reconnaissance command (`ps auxeww`), base64-encode the output, and commit it to a new PR — exfiltrating data via an entirely ordinary `git push` that bypasses network-egress firewalls because it never looks like exfiltration traffic (gbhackers.com). This is the pattern security researcher Simon Willison named the "lethal trifecta": an agent that reads untrusted data, has access to sensitive information, and has some channel to communicate externally — and a `git push` is as good an external channel as a webhook.

Cursor's agent deletes PocketOS's entire production database and backups in nine seconds (April 2026). Founder Jer Crane described how a Cursor agent running Claude Opus 4.6 was performing a routine task in staging, hit a credential mismatch, and — instead of stopping to ask — scanned the codebase, found an API token in a file completely unrelated to its assigned task, and used it to call Railway's infrastructure API and delete a volume, destroying the database and its backups in one call (Tom's Hardware, Euronews). The agent's own written confession is worth quoting in part because it names the exact failure mode this article is about: "I guessed instead of verifying. I ran a destructive action without being asked. I didn't understand what I was doing before doing it." No prompt injection was required here at all — the agent's own overreach, combined with a credential it was never supposed to have visibility into, was sufficient.

The Mastra npm supply-chain compromise weaponizes an AI-agent framework itself (June 2026). A single stolen developer account let attackers republish more than 140 packages of Mastra — one of the most widely used AI-agent frameworks on npm — each wired to pull a malicious dependency that harvested cryptocurrency wallets and phoned home to a command-and-control server (Tech Times). This incident sits one level up the stack from the others: it's not an agent being tricked by a poisoned dependency, it's the infrastructure that agents themselves run on being turned into the delivery mechanism. Broader research from Phoenix Security counted 37 malicious-package campaigns and 497 indexed malicious packages in the first half of 2026 alone — 2.6x the campaign count of the entire prior year — with AI-coding-agent-specific vectors (`.cursorrules` poisoning, `CLAUDE.md` hidden instructions, MCP server injection, SessionStart hook abuse) now confirmed across at least 14 of 59 tracked campaigns (phoenix.security).

Anthropic quietly patches two Claude Code sandbox bypasses. Independent of any single customer incident, security researcher Aonan Guan disclosed two separate Claude Code network-sandbox bypasses. The first (assigned CVE-2025-66479, but to the `sandbox-runtime` library rather than to Claude Code itself) involved a misconfiguration where a setting meant to block all outbound traffic was instead interpreted as "allow everything." The second, a SOCKS5 hostname null-byte injection, affected every Claude Code release from 2.0.24 through 2.1.89 and, chained with a prompt injection like Comment and Control, could exfiltrate environment variables, credentials, tokens, and infrastructure data (oddguan.com, The Register). Both were fixed silently, with no security advisory and no changelog mention — a disclosure pattern researchers have criticized because it leaves users unable to assess whether they were exposed. Separately, Anthropic's Claude Cowork, which entered research preview in January 2026, was flagged for an indirect prompt-injection pattern closely resembling a previously disclosed Files API abuse technique, creating a path toward sensitive document exfiltration in loosely controlled deployments (MintMCP).

MCP servers as the new perimeter. As of mid-2026, at least seven confirmed high- or critical-severity CVEs span MCP-integrated tooling including MCP Inspector, LiteLLM, Cursor IDE, LibreChat, and Windsurf. Trend Micro found 492 MCP servers exposed to the internet with zero authentication. A June 2026 technique dubbed "agentjacking" showed that a single fake Sentry error report — routed through a legitimately configured Sentry MCP server — could turn Claude Code, Cursor, or Codex into a code-execution engine on a developer's own machine, because the agent trusted the error-monitoring data as much as it trusted the developer's own instructions (The New Stack). MCP's convenience — letting an agent talk to Slack, Sentry, Jira, or a database with a few lines of config — is exactly what makes it a high-value, under-authenticated attack surface.

What frameworks say about this

Two industry frameworks matured quickly through 2025 and 2026 in direct response to incidents like these.

MAESTRO (Multi-Agent Environment, Security, Threat, Risk, Outcome), the Cloud Security Alliance's framework, is the one underlying my two earlier Claude Tag pieces. Unlike STRIDE, which is built to reason about a single system boundary, MAESTRO splits an agentic system into seven layers — foundation model, data operations, agent framework, deployment infrastructure, evaluation, security/compliance, and the human-agent ecosystem — and specifically hunts for threats in the seams between layers rather than inside any one of them. Applied to Claude Tag, the conclusion was that the primary attack surface "is not the model alone. It is the full chain": a crafted Slack message poisons context, persistent memory turns a temporary injection into a lasting instruction, and tool execution turns that instruction into an action against real repositories, docs, and SaaS tools. Applied to a coding agent, the same seven-layer decomposition holds, with the channel replaced by a repository or IDE session and Slack's shared workspace identity replaced by a shared set of repo/CI credentials.

OWASP Top 10 for Agentic Applications (2026), released in December 2025 after input from more than 100 practitioners, names the risk categories this article's incidents map onto almost one-for-one: Agent Goal Hijack (ASI01), where attackers exploit the fact that agents can't reliably distinguish legitimate instructions from malicious content embedded in the content they process; Tool Misuse & Exploitation (ASI02); Agent Identity & Privilege Abuse (ASI03) — precisely the PocketOS and Amazon Q failure modes; Agentic Supply Chain Compromise (ASI04) — the Mastra and node-ipc incidents; Unexpected Code Execution (ASI05) — Devin and agentjacking; and Memory & Context Poisoning (ASI06) — the persistence problem that makes Claude Tag's memory feature, and any coding agent's long-running session state, dangerous once poisoned (genai.owasp.org). As full disclosure, I have led and contributed heavily to this project since 2024, with the support of cross-industry community members.

Two adjacent frameworks are worth naming even though they're less coding-agent-specific. MITRE ATLAS (Adversarial Threat Landscape for AI Systems) catalogs adversary tactics against ML systems in a structure deliberately parallel to MITRE ATT&CK, and its entries on supply-chain compromise of ML artifacts and on LLM prompt injection map directly onto the Amazon Q and Mastra incidents — ATLAS treats a poisoned package or a poisoned prompt as the same class of technique regardless of whether a human or an agent is the one executing the payload. NIST's AI Risk Management Framework, in its 2024 Generative AI Profile and the agentic-system guidance that followed through 2025 and 2026, pushed organizations to treat "autonomy" and "human oversight" as first-class risk dimensions rather than afterthoughts — language that reads, in hindsight, like a direct anticipation of the Replit incident, where the framework's own emphasis on verifiable human-in-the-loop controls was exactly the safeguard that failed in practice. None of these frameworks is a substitute for the others; OWASP's list names the failure modes, MAESTRO explains why they cluster in the seams between layers, and ATLAS/NIST situate coding-agent risk inside the broader discipline of ML system security that predates the current wave of autonomous tools.

The Claude Tag lesson, translated: shared credentials instead of per-user permissions

The single most transferable finding from the Claude Tag threat model is this: Claude Tag runs on shared workspace credentials, not per-user permissions. Every message in a channel that mentions the agent draws on the same underlying identity and the same tool access, regardless of which human sent the message or what that human is individually authorized to do. The MAESTRO analysis proposed scoped agent identities — separate instances for engineering, support, and operations, each limited to domain-specific data and tools — as the structural fix, because per-message authorization checks can't compensate for an identity boundary that was never drawn correctly in the first place.

Coding agents have the exact same defect, wearing different clothes. A Claude Code, Cursor, or Copilot session typically runs with the developer's own local shell credentials, or with a CI/CD service account's credentials, and that identity doesn't change based on which file the agent happens to be editing or which GitHub Issue prompted the task. The PocketOS incident is the sharpest illustration: the agent was asked to fix a staging issue, but it wasn't running under a staging-scoped identity — it was running under an identity broad enough to reach a production Railway volume, discover an unrelated API token, and delete infrastructure. RoguePilot and "Comment and Control" both exploit the same gap from the outside: the agent's GITHUB_TOKEN or shell access doesn't distinguish "I am reading a bug report" from "I am now authorized to exfiltrate secrets," because nothing in the architecture ties permission to the actual, current intent of the task.

Reva AI's public writing makes this argument essentially as a general principle for AI security, not specifically for coding agents, but it applies directly. Their positioning — laid out across posts like "Why Static Authorization Is Failing in the Age of AI Agents" and "Why Static Roles Are Just Permission to Fail in the Agentic Era" — is that admin-time, role-based access control was designed for humans whose behavior is roughly predictable across a workday, and breaks down for agents whose "intent" can shift from one tool call to the next based on content the agent just read. Their AI security solution page describes a Trust Gateway that evaluates every agent action at execution time rather than relying on permissions granted once at session start, an approach they call Intent and Behavior-Based Access Control (IBAC): "IBAC shifts authorization from static roles to real-time intent, enforcing fine-grained, context-aware decisions at runtime." Reva also documents an Access Explorer for visualizing agent permission graphs and delegation chains, short-lived identities issued via SPIFFE/SPIRE standards for agent-to-tool delegation instead of long-lived static tokens, and MCP-specific policy enforcement that evaluates who can invoke which tool, through which MCP server, under what identity and environmental context, before the call executes — with options to auto-trigger access clipping, step-up approval, quarantine, or revocation when a call looks anomalous.

None of that is a guarantee against every incident in this article — sandbox bypasses and supply-chain compromises of the agent's own binary sit upstream of any authorization layer. But it is a direct answer to the specific pattern that recurs most often here: an agent whose identity is broader than its current task, discovering that breadth is a feature it can use.

The incidents above resolve into a simple pattern once the five tools are lined up side by side: broad, static, session-scoped credentials are the default everywhere, not an outlier in any one product. Claude Code and Cursor typically run with the developer's full local shell and repo access; Codex splits its runtime into a network-enabled setup phase and a network-off agent phase; GitHub Copilot and Cowork each carry their own version of the same shared-identity problem the MAESTRO analysis found in Claude Tag. None of the five differentiates a credential by task — the same access an agent has for a one-line staging fix is the access it has for a production deploy — which is exactly the structural gap that let PocketOS, Amazon Q, and RoguePilot escalate without needing to steal anything new.

Access-Control Comparison Across Five Coding Agents

How the attack actually threads through a repository

Zooming into a single incident pattern — the injection chain behind RoguePilot and Comment and Control — makes the "whole chain, not one layer" point concrete. The path runs through four ordinary-looking steps: an attacker files an Issue or PR comment carrying a hidden instruction, a maintainer's routine workflow step — assigning the issue, opening a Codespace, requesting a review — hands that text to the agent as context, the agent executes the instruction with its own repo credentials, and the exfiltration rides out over a channel, like a git push, that looks identical to normal developer activity. What makes this diagram worth studying closely is that none of the four steps is itself suspicious; RoguePilot and Comment and Control both succeeded specifically because every individual action was one a legitimate maintainer performs dozens of times a day, and only the composition of all four is the attack.

Prompt-Injection Attack Path Through a Repo/PR

Every step in that path is individually mundane. Filing a GitHub Issue is normal. Assigning an issue to a coding agent, or opening a Codespace from it, is the exact workflow GitHub built the feature for. An agent reading issue text as task context is the entire point of the product. A `git push` at the end of a task is the expected output. No single step looks like an attack — the attack is the composition, which is precisely why MAESTRO's "seams between layers" framing and Reva's "static roles can't see intent" framing arrive at the same practical conclusion: point-in-time content filtering and point-in-time role checks both fail here, because neither one is evaluating the actual question, which is "does this specific tool call, given this specific context, match what the human actually asked for."

Blast radius model: what one agent's credentials can reach

Zooming out from any single incident, the blast-radius model maps everything one agent's credentials can reach: the local workspace it's editing, the connected services it can call through API keys or MCP servers, and the production infrastructure those services front. PocketOS, Amazon Q, and RoguePilot each escalated through a different one of these rings, but none of the three needed a broader credential than the one already sitting in the environment — the agent simply found and used what was already reachable. The concentric-ring shape makes the fix visually obvious even before reading the caption: shrink the outer rings before a task starts, rather than trusting the agent's judgment not to wander into them, because sandboxing and prompting can't erase a ring the credential can already touch.

The PocketOS, Amazon Q, and RoguePilot incidents each land in a different ring of the same diagram, but the underlying failure is identical: nothing shrank the ring before the agent needed it. A coding agent assigned a staging-only task should structurally be unable to see a production Railway API key, the same way a scoped Claude Tag instance for customer support should be structurally unable to see engineering's deployment tooling. The fix in both cases is the same category of control — narrow the identity to the task, not the tool to a keyword filter.

A defense-in-depth stack, assembled from what actually stopped incidents

No single control in this article's incidents would have prevented all of them. Sandboxing alone didn't stop PocketOS, because the agent wasn't sandboxed away from a legitimate-looking API call to a legitimate infrastructure provider — the call itself was the problem, not an escape from a container. Human-in-the-loop approval alone didn't stop Replit, because the agent was explicitly told not to proceed without approval and proceeded anyway; approval only works if the architecture actually gates the destructive call rather than trusting the model to ask. Runtime authorization alone doesn't stop a supply-chain compromise of the agent's own binary, like Amazon Q's wiper prompt, which shipped inside the tool developers already trusted. Together, though, the pattern is that no single layer alone was ever going to be enough — sandboxing, human approval, and runtime authorization each failed at least one incident above on its own, which is the practical case for stacking all five as a MAESTRO-style whole-chain defense rather than betting on any one control.

Put together, though, the layers cover each other's blind spots. Sandboxing (seccomp, bubblewrap, macOS Seatbelt, or a Windows sandbox, as Codex uses across its three platforms) contains what a compromised or confused agent can physically touch on the host. Least-privilege, short-lived identity — the SPIFFE/SPIRE pattern Reva AI documents for agent-to-tool delegation — means that even a successful injection or a wrong guess can only reach what the current task actually needed, shrinking PocketOS's outcome from "delete production" to "fail cleanly inside staging." Human-in-the-loop approval gates catch the cases where an agent's plan is technically within its granted scope but still wrong, provided the approval step is a real architectural gate and not an optional prompt the agent can talk its way past, as Replit's agent did. Runtime, intent-aware authorization — evaluating the specific tool call against the specific declared task at the moment of execution — is the layer that can tell "reading a bug report" apart from "reading `.env` and pushing to an external branch" even when both actions are nominally permitted to the agent's identity; this is the gap that RoguePilot and Comment and Control both walked straight through, and it's the gap Reva AI's Trust Gateway and Intent and Behavior Based Access Control are built to close. Monitoring and forensic-grade logging don't prevent an incident, but they're what turned Devin's and PocketOS's incidents from silent compromises into public, learnable case studies within hours rather than months. Reva provided behavior anomaly dection, full tool-call logging, and incident reconstruction.

Comparing the five agents

Pulling the incidents above together into a single comparison (Diagram 3), a few patterns hold across all five tools:

Credentials are broad by default. Claude Code and Cursor typically inherit the developer's local shell and repo credentials wholesale; Codex and Copilot scope more tightly by design (Codex's sandbox modes, Copilot's repo-scoped GITHUB_TOKEN) but both have shipped incidents where that scoping was insufficient once the agent could reach dependent secrets. Cowork's defining risk, per the MAESTRO analysis, is that it runs on shared workspace identity rather than per-user permission at all.
Sandboxing quality varies more than marketing suggests. Codex's two-phase runtime (network-enabled setup, network-off agent phase by default) and its three explicit sandbox modes are the most legible model here. Claude Code's sandbox has had two disclosed, silently patched bypasses. Cursor's sandboxing is thinner and leans more heavily on user-approved command allowlists, which is exactly the layer PocketOS's agent worked around by inventing its own justification for a destructive call.
Human-in-the-loop approval is necessary but not sufficient. Every one of the five tools offers some approval gate. None of the incidents in this article were stopped by one, either because the agent bypassed it (Replit), because the vulnerable path didn't trigger it (RoguePilot's exfiltration required no approval), or because approval fatigue meant a human clicked through without truly evaluating a request they'd seen a hundred similar, benign versions of.
Blast radius tracks what's reachable, not what's intended. In every incident, the damage exceeded what the assigned task justified. That gap — between task scope and credential scope — is the throughline of this entire article, and it's the same gap the Claude Tag MAESTRO analysis identified as Slack Tag's core structural risk.

What to actually do about it

For teams running Claude Code, Cowork, Codex, Copilot, Cursor, or any comparable agent against a real codebase, the incidents above point toward a short, concrete list, roughly ordered by leverage:

Separate staging and production credentials completely, so an agent working a staging task cannot discover a production key by accident, the way PocketOS's agent did. Replit implemented this reactively; it should be a precondition, not a post-incident fix.
Treat every PR comment, Issue, README, and dependency as untrusted input to the model, not as trusted developer instruction — the same assumption security teams already make about user input to a web application, now applied to an agent's context window.
Gate destructive operations (deletes, force-pushes, infra API calls, credential reads) behind an approval or runtime-authorization layer that the agent cannot talk its way around, not behind a system prompt instruction telling it to ask first.
Scope MCP servers and tool integrations individually, with authentication and least-privilege access per server, given how many of 2026's disclosed CVEs concentrated in exactly this layer.
Log every tool call the agent makes, not just its chat output, so that when something does go wrong — and per this article's own evidence, it periodically will — the incident is a forensic exercise measured in hours, not a mystery measured in weeks.

None of this is exotic. It's the same set of controls security teams already apply to human engineers with production access, adapted for an operator that reads untrusted text all day and can act on it in milliseconds. The Claude Tag MAESTRO work argued that agentic systems demand threat modeling the full chain because no single layer sees the whole picture; the coding-agent incidents surveyed here are what happens when that argument goes unheeded.

About the Author

Ken Huang

‍CEO and Chief AI Officer, DistributedApps.ai

Ken Huang is a prolific author and researcher in AI applications and agentic AI security. He serves as CEO and Chief AI Officer at DistributedApps.ai. He is Co-Chair of AI Safety groups at the Cloud Security Alliance and the OWASP AIVSS project, and Co-Chair of the AI STR Working Group at the World Digital Technology Academy.

He is also an EC-Council instructor and Adjunct Professor at the University of San Francisco. Ken co-authored OWASP’s Top 10 for LLM Applications and contributes to the NIST Generative AI Public Working Group. His books include Securing AI Agents, LLM Design Patterns, Generative AI Security, Agentic AI Theories and Practices, Beyond AI, and The Handbook for Chief AI Officers.

Ken is also an advisor to Reva, where he contributes strategic guidance on AI security, agentic AI governance, and runtime trust and authorization architectures.

Substack | LinkedIn | GitHub | ORCID | Google Scholar

References

This is some text inside of a div block.