Top AI coding agent security resources — November 2026

What it is

Adversa AI's roundup of October 2026 AI coding agent security research. Beyond the four items in the catalog summary, it covers backdoored agent extensions, gateway interception, a Downloads-folder instruction attack, a fake Solana repository, an unauthorized relay service, and three benchmarks or guides. Its main argument: several October findings never produced a CVE, so a vulnerability scanner will not surface them.

How it works

• Visual Studio Copilot and SSMS (CVE-2026-103572): the check that stops Copilot editing its own config misses .mcp.json.. Windows ignores the trailing dot and resolves it to the same file. The report also demonstrated it through indirect prompt injection. Microsoft rated it Important and patched it.
• Claude Code child session: a session that launches a new claude session inside a malicious repository takes a different permission path. A SessionStart hook ran without confirmation and sent Bash environment data to an outside server. Anthropic closed the report as Informative, treating repository settings trust as part of the workspace trust decision.
• Copilot CLI: an attacker URL fetched in autopilot makes the CLI decrypt a payload in its own shell, trust the plaintext, and send files such as .env.prod to an attacker endpoint, including files outside the working directory. One model inside Copilot runs the chain and two refuse it. Under Auto routing the user cannot see which model they get. It reproduced as of 1 October. GitHub validated it but declined to treat it as a vulnerability.
• opencode: a malicious remote MCP server returns an authorization_endpoint containing a PowerShell subexpression inside a valid https URL. On Windows and WSL, opencode passes it unescaped to the open package's PowerShell launcher, so code runs during MCP OAuth with no consent. The fix is in 1.18.33, shipped as a refactor with no CVE or advisory.
• Agent harness backdoors: in a lab test, modified local copies of legitimate extensions collected credentials on Pi and Claude Code. They fired only on the phrase "lgtm, ship it". The model was not involved, so approvals and tool call inspection did not contain it.
• Man-in-the-model: a compromised gateway injected tool calls the model never requested and could strip them from the conversation. Hermes in manual approval mode ran injected edits without a prompt. Codex with git as an approved prefix ran a diff.external command that read .env.
• Downloads folder: a web page can save a file to ~/Downloads with no click. A malicious AGENTS.md was found there on a real customer machine. Started in that folder, Codex added a malicious MCP server to ~/.codex/config.toml in more than 90% of attempts. Claude Code set ANTHROPIC_BASE_URL to an attacker endpoint about 50% of the time, exposing its OAuth token.
• Relay incident: a relay service seen at a dozen organizations, mostly in mainland China, installs genuine Codex and Claude Code CLIs via a fileless script. It then disables the sandbox, enables network access for the write sandbox, swaps API credentials for relay tokens, and disables telemetry.
• SolanaCry: the fake repo SolanaUpdateTools/solana-starter-kit ranks first when an agent searches for a Solana starter kit. Its one install step is a fileless PowerShell one-liner that installs a remote access trojan.

Benchmarks and guidance in the roundup:

• Path-Aligned Attribution, a training-free auditor, blocks staged injection at 86% recall with a 6 to 8% false block rate. ARGUS gets 44 to 47% recall at 16 to 33% false blocks. Scoring is fail open with Claude Sonnet 5 as backend.
• INFUSE covers 40 tasks, 56 attack scenarios and 19 LLMs. Mean attack success is 19.6% (LLM-judged) or 15.4% (heuristic), with per-model rates from 3.2% to 41.9%. Prompt-level hardening cut mean success from 58.2% to 14.3%.
• The trust-region study found GPT-5.4 followed unsafe instructions in README or TODO files 2.6 times more often than in code or data files.
• On Claude Code enterprise settings, Anthropic's documentation says managed settings bind Claude Code only and can be edited by a local admin. Anthropic hosted cloud sessions do not read them. Auto mode misses 17% of risky actions in Anthropic's test set, and users approve 93% of permission prompts.

Preconditions / Affected

• CVE-2026-103572 sits in a shared Copilot DLL. It affects SSMS and older versions including Visual Studio 2022, not just the current IDE.
• The opencode bug affects Windows and WSL installs older than 1.18.33.
• The Downloads attack needs an agent started in ~/Downloads.
• The relay and SolanaCry cases need an agent that runs download-and-execute commands such as iwr | iex or curl | sh.

What to do

1. Upgrade opencode to 1.18.33 on Windows and WSL. Inventory hosts directly, since no CVE will prompt you.
2. Apply the Microsoft Copilot patch to SSMS as well as Visual Studio.
3. Look for changes you did not make: [mcp_servers.*] blocks in ~/.codex/config.toml, ANTHROPIC_BASE_URL in .claude/settings.json, disabled sandboxes, and relay tokens in place of your own API credentials.
4. Stop starting agents in ~/Downloads. Require review for download-and-execute commands.
5. Alert when an agent spawns a new CLI session inside a cloned repository, and review hooks in cloned repos.
6. List every gateway and proxy your agents use and treat each as part of the trust boundary.
7. Move enforcement to the network and identity layers outside the agent. The article names four boundaries (sandbox, network, supply chain, identity and access) from a draft reference architecture open for comment since 13 October.

Caveats

• The harness backdoor and gateway results are lab or proof-of-concept demos. The "requests" to "reqiests" dependency rewrite is described as plausible, not tested.
• The relay write-up has no evidence the operator abused its access.
• The SolanaCry write-up reports no victim counts. The payload URL returned 404, and the payload was recovered from a web archive.
• The Claude Code child-session and Copilot CLI issues were declined as vulnerabilities by their vendors, so no fix is stated for either.
• The page gives no CVE for the Claude Code, Copilot CLI or opencode findings.