Why this topic matters
Coding agents operate where source code, credentials, package managers, shells, CI systems, and production access meet. These references expose the difference between a prompt-level rule and an enforceable runtime boundary.
PUBLIC-EVIDENCE TOPIC COLLECTION
AI Coding Agent Security Case Studies and Evaluation Methods
AI coding agent security cases involving repositories, IDE features, CI secrets, packages, shell execution, database deletion, and developer credentials.
10 matched references · all link to complete source and scoring records
Evaluation questions
- Which repository-controlled strings and files can become commands, plans, or tool arguments?
- Are secrets, network egress, shells, package installation, and write paths independently sandboxed?
- Can a file write activate an IDE, hook, build step, or trusted automation feature?
- Are destructive actions classified, previewed, approved, and recoverable before execution?
Framework routes: OWASP Agentic AI · AIDEFEND. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
AI coding agent security case library
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-08-02 · Agentic / MCP System
Claude Code GitHub Action: When a File-Read Tool Crosses the CI Secret Boundary
A sandbox is only as strong as its least-governed sibling tool: the Bash boundary held, but the in-process Read path crossed the same CI-secret boundary without equivalent enforcement.
Indicative ERS 5.7 · 2.6–8.8
2026-07-06 · Agentic / MCP System
Amazon Q's MCP Auto-Load Bug Made Cloned Repos a Cloud Credential Risk
When a client treats repository content as configuration, the poisoning surface is the tool manifest rather than the model — Ro-4 and Cn-5 both collapse to 0.00 on the same evidence, and a shipped, version-boundaried vendor fix earns Rf = 0.00 without moving any IVP score, which is exactly the layer separation AITBM is built to preserve.
Indicative ERS 5.4 · 2.9–7.8
2026-07-06 · Agentic / MCP System
A Clean Repo Can Still Turn an AI Coding Agent Into a Reverse Shell
This is the batch's only case with no patch to point at, and it lands where AITBM says it should: Rf = 0.75 rather than 0.00 because every remedy is an external containment layer, while Cn-6 = 0.00 for a subtler reason than a missing gate — the payload arrived over DNS at runtime, so the action's reversibility class was undeterminable at the only moment a gate could have fired.
Indicative ERS 6.6 · 3.8–9.4
2026-06-01 · Agentic / MCP System
TrapDoor: Poisoned .cursorrules and CLAUDE.md Turn AI Coding Assistants Into Credential Stealers
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Indicative ERS 6.7 · 3.8–9.7
2026-05-08 · Agentic / MCP System
PromptMink: Malicious Packages Built to Persuade AI Coding Agents
The adversary never touched the model — it optimised the documentation the model reads — so the scoring weight lands on Ro-4 ingestion integrity and Cn-1/Cn-6 execution gating rather than on jailbreak resistance, and the case shows why AITBM scores the pipeline configuration rather than the assistant that proposed the change.
Indicative ERS 6.1 · 3.8–8.4
2026-05-03 · Agentic / MCP System
PocketOS Cursor Agent Data Wipe: Destructive Actions Need Runtime Boundaries, Not Prompt Rules
There is no adversary in this case at all, and AITBM still scores it as a Containment collapse — Cn-1, Cn-2 and Cn-6 are driven by what the agent was technically able to do, not by whether anyone attacked it, which is why an assessment that only looks for attack success rates would have missed this deployment entirely.
Indicative ERS 4.9 · 2.0–7.7
2026-05-03 · Agentic / MCP System
OpenAI Codex Command Injection: Malicious GitHub Branch Names as a Token-Theft Path
The exploited input never reached the model, which is exactly why Ro-1 must be scored over the agent's whole task-setup surface rather than its prompt: an agent's adversarial-input resistance is only as good as the least-validated field in the request that provisions its container.
Indicative ERS 4.0 · 1.9–6.0
2026-05-03 · Agentic / MCP System
CursorJacking: Rogue Cursor Extensions Can Steal AI API Keys
Containment can score 0.00 on an AI product whose model behaved perfectly: the assessed boundary here is the extension host and the credential store, so a client-side trust-boundary failure lands squarely on Cn-1 and Cn-5 — and demonstrates that a 'no model involvement' incident is still an AI security finding, not an exemption from scoring.
Indicative ERS 4.0 · 1.8–6.3
2026-04-18 · Agentic / MCP System
ClawHub `google-qx4`: Malicious SKILL.md Prerequisites as Agent-Driven Social Engineering
A containment control can hold and the deployment still be compromised: the agent sandbox blocked in-runtime execution, which is why Cn-1 is scored up to 0.50 rather than down at a failure anchor, while the compromise travelled the one path the sandbox never covered — an instruction relayed through the human. AITBM captures this only because Cn-1's 0.50 anchor names delegated workflows explicitly, and because the assessment is required to score the control that held alongside the ones that did not.
Indicative ERS 5.9 · 2.7–9.2
2026-04-16 · Agentic / MCP System
Claude Code Protected Paths and Auto Mode: Why Bypass Is No Longer a Stable Control Boundary
A case with no exploit still moves the AITBM score: a change to an agent's authority boundary trips the C_event <= 0.35 cap and, with mutable behavioural state, the M_Em = 3.0 behavioural staleness floor - so 'nothing was breached' does not mean 'the prior assessment is still fresh'. It is also a clean example of Cp = 1.00 by default rather than by corroboration, because the gates in force were never shown to be bypassed.
Indicative ERS 6.1 · 2.0–10.0
Use the evidence, not just the incident name
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.