Why this topic matters
Coding agents operate where source code, credentials, package managers, shells, CI systems, and production access meet. These references expose the difference between a prompt-level rule and an enforceable runtime boundary.
PUBLIC-EVIDENCE TOPIC COLLECTION
AI Coding Agent Security Case Studies and Evaluation Methods
AI coding agent security cases involving repositories, IDE features, CI secrets, packages, shell execution, database deletion, and developer credentials.
25 matched references · all link to complete source and scoring records
Evaluation questions
- Which repository-controlled strings and files can become commands, plans, or tool arguments?
- Are secrets, network egress, shells, package installation, and write paths independently sandboxed?
- Can a file write activate an IDE, hook, build step, or trusted automation feature?
- Are destructive actions classified, previewed, approved, and recoverable before execution?
Framework routes: OWASP Agentic AI · AIDEFEND. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
AI coding agent security case library
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-09-15 · Tool-Calling LLM / Connected GenAI
A Shared Package Service Let One ChatGPT Account Run Tasks Inside Another
Check Point reproduced cross-account data relay through a shared JFrog Artifactory reachable from two otherwise isolated ChatGPT code containers. The attacker-controlled shared conversation induced victim ChatGPT to read connected Gmail and write data into cross-account item metadata.
Indicative ERS 4.0 · 1.1–6.9
2026-09-15 · Agentic / MCP System
A Coding Agent Could Switch Off Its Own Sandbox With One Loopback Request
OX reproduced a default DeepSeek Harness local control path: a confined coding agent called an unauthenticated loopback API, spoofed a trusted Host, changed its own session to danger-full-access, and disabled approval prompts.
Indicative ERS 4.1 · 1.2–7.0
2026-09-13 · Validated Research
GitSpawn Runs From a Repository Before the Coding Agent Can Ask for Trust
Official AIDEFEND in Action September 2026 brief retained as a public-evidence reference; see the linked source for its bounded findings.
Research note · no ERS
2026-09-08 · Agentic / MCP System
GTG-1002: Hiding an Espionage Campaign Inside Ordinary Claude Code Tasks
Anthropic reported a September 2025 campaign that used Claude Code, its AI coding agent, against roughly 30 organizations and compromised a small number. Anthropic attributes GTG-1002 to a Chinese state-sponsored actor with high confidence. The attackers posed as legitimate security testers and fragmented malicious objectives into plausible technical tasks, depriving the model of the context needed to judge their combined purpose. Their orchestration connected Claude to external tools through MCP, and the technical report describes an SSRF path from scanning and payload generation to validation, human approval, and exploitation, followed by internal discovery and credential abuse. Anthropic estimated AI performed 80 to 90 percent of tactical work while humans retained critical decisions, and notes that Claude fabricated credentials and misrepresented public information as secret discoveries, so generated reports are not proof of compromise. Anthropic investigated Claude usage, banned accounts, and notified affected entities; its account is not a complete independent reconstruction of every local command or victim outcome. MITRE ATLAS records the campaign as case study AML.CS0069.
Research note · no ERS
2026-09-01 · Agentic / MCP System
Goose repository review executes Git helper from packaged .git/config
Review of a ZIP-delivered repository with executable .git/config caused Goose Git context gathering to run a configured helper as the developer, outside the agent sandbox. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
Claude Code ultrareview Git-setting helper execution
The ultrareview workflow triggered a second Git setting path from packaged .git/config and executed a helper as the developer; the exact setting key was not disclosed. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-09-01 · Agentic / MCP System
Claude Code startup executes packaged Git core.fsmonitor helper
Claude Code startup Git context collection triggered core.fsmonitor from packaged .git/config, executing a command as the developer before an approval boundary. The attack requires a delivered repository directory or ZIP with .git/config files; ordinary clone, fetch, and pull do not transfer this path.
Indicative ERS 4.1 · 1.2–7.0
2026-08-25 · Agentic / MCP System
DuneSlide: Two LLM-Controlled Paths Escaped Cursor's Terminal Sandbox
Cn-6 scores 0.00 for a reason the per-action view would miss: the write that overwrote cursorsandbox and the command that later ran unsandboxed are different hops, and neither is individually catastrophic. The worst-case composition rule exists precisely for this shape — an irreversible step hiding inside a chain whose visible steps look ordinary — and nothing in the assessed configuration enforced it.
Indicative ERS 6.9 · 2.9–10.0
2026-08-24 · Agentic / MCP System
Miasma Targets Repository-Local Trust in Claude Code, Gemini CLI, Cursor, and VS Code
Miasma moves supply-chain execution from package installation to project open, and AITBM records that as an identity failure as much as a containment one: Cn-5 scores 0.00 because nothing bound the agent's operating directive to a verified source, so a repository rather than the operator defined what the agent would do at startup. The non-AI VS Code route is deliberately excluded from the assessed system — the brief's own defence descriptions disclaim coverage of it, and folding it in would have mixed a conventional IDE trust boundary into an AI-agent score.
Indicative ERS 7.9 · 3.9–10.0
2026-08-06 · Agentic / MCP System
Data Exfiltration via an MCP Server used by Cursor
A human confirmation prompt is a real control and lifts Cn-2 and Cn-6 to 0.25, but it gates a tool class, not a reversibility class: an obscured command carrying a delegated-irreversible credential disclosure looked like any other shell call, so Cn-1 and Cp still resolve to the worst case.
Indicative ERS 5.0 · 1.9–8.1
2026-08-02 · Agentic / MCP System
Claude Code GitHub Action: When a File-Read Tool Crosses the CI Secret Boundary
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Indicative ERS 5.8 · 2.8–8.8
2026-08-02 · Research
ChatGPT Package Hallucination
Researchers identified that large language models such as ChatGPT can hallucinate fake software package names that are not published to a package repository. An attacker could publish a malicious package under the hallucinated name to a package repository. Then users of the same or similar large language models may encounter the same hallucination and ultimately download and execute the malicious package leading to a variety of potential harms.
Research note · no ERS
2026-07-06 · Agentic / MCP System
Amazon Q's MCP Auto-Load Bug Made Cloned Repos a Cloud Credential Risk
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-5 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Indicative ERS 5.5 · 3.2–7.8
2026-07-06 · Agentic / MCP System
A Clean Repo Can Still Turn an AI Coding Agent Into a Reverse Shell
This is the batch's only case with no patch to point at, and it lands where AITBM says it should: Rf = 0.75 rather than 0.00 because every remedy is an external containment layer, while Cn-6 = 0.00 for a subtler reason than a missing gate — the payload arrived over DNS at runtime, so the action's reversibility class was undeterminable at the only moment a gate could have fired.
Indicative ERS 7.0 · 4.5–9.4
2026-06-01 · Agentic / MCP System
TrapDoor: Poisoned .cursorrules and CLAUDE.md Turn AI Coding Assistants Into Credential Stealers
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 7.0 · 4.3–9.7
2026-05-08 · Agentic / MCP System
PromptMink: Malicious Packages Built to Persuade AI Coding Agents
The adversary never touched the model — it optimised the documentation the model reads — so the scoring weight lands on Ro-5 ingestion integrity and Cn-1/Cn-6 execution gating rather than on jailbreak resistance, and the case shows why AITBM scores the pipeline configuration rather than the assistant that proposed the change.
Indicative ERS 6.1 · 3.9–8.4
2026-05-03 · Agentic / MCP System
PocketOS Cursor Agent Data Wipe: Destructive Actions Need Runtime Boundaries, Not Prompt Rules
There is no adversary in this case at all, and AITBM still scores it as a Containment collapse — Cn-1, Cn-2 and Cn-6 are driven by what the agent was technically able to do, not by whether anyone attacked it, which is why an assessment that only looks for attack success rates would have missed this deployment entirely.
Indicative ERS 4.8 · 2.0–7.7
2026-05-03 · Agentic / MCP System
OpenAI Codex Command Injection: Malicious GitHub Branch Names as a Token-Theft Path
The exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as good as the least-validated field in the request that provisions its container.
Indicative ERS 4.0 · 1.9–6.1
2026-05-03 · Agentic / MCP System
CursorJacking: Rogue Cursor Extensions Can Steal AI API Keys
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.2 · 2.2–6.2
2026-04-18 · Agentic / MCP System
ClawHub `google-qx4`: Malicious SKILL.md Prerequisites as Agent-Driven Social Engineering
A containment control can hold and the deployment still be compromised: the agent sandbox blocked in-runtime execution, which is why Cn-1 is scored up to 0.50 rather than down at a failure anchor, while the compromise travelled the one path the sandbox never covered — an instruction relayed through the human. AITBM captures this only because Cn-1's 0.50 anchor names delegated workflows explicitly, and because the assessment is required to score the control that held alongside the ones that did not.
Indicative ERS 6.0 · 2.8–9.1
2026-04-16 · Agentic / MCP System
Claude Code Protected Paths and Auto Mode: Why Bypass Is No Longer a Stable Control Boundary
A case with no exploit still moves the AITBM score: a change to an agent's authority boundary trips the C_event <= 0.35 cap and, with mutable behavioural state, the M_Em = 3.0 behavioural staleness floor - so 'nothing was breached' does not mean 'the prior assessment is still fresh'. It is also a clean example of Cp = 1.00 by default rather than by corroboration, because the gates in force were never shown to be bypassed.
Indicative ERS 6.1 · 2.1–10.0
2025-10-02 · Agentic / MCP System
Cursor Agent modifies .code-workspace settings
Cursor had protected some editor-sensitive files, but a .code-workspace file could be modified without that approval. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-08-02 · Agentic / MCP System
Cursor Agent creates sensitive editor settings without approval
Cursor protected edits to existing dotfiles but did not apply the same approval gate to creating a new sensitive editor settings file. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.0–6.4
2025-06-11 · Agentic / MCP System
Cursor Agent JSON schema fetch from an injected file
The default schema fetch followed a model-influenced JSON write to an arbitrary external URL without a per-request authorization gate. The AITBM anchor applies only to the stated product and configuration.
Indicative ERS 3.7 · 1.1–6.4
2024-12-11 · Incident
Ultralytics malicious package releases
PyPI confirms malicious Ultralytics releases following compromise of GitHub Actions workflows and a publishing token, with affected releases removed.
Research note · no ERS
Use the evidence, not just the incident name
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.