Top AI Coding Agent security resources — August 2026

What it is

This August 2026 digest aggregates 19 distinct AI coding agent security resources, most already named in the catalog summary. But the page carries specific per-item mechanisms, benchmark numbers, and a named prior attack class the summary omits.

How it works

• MOSAIC: a CLI command composition attack where individually benign commands form a dangerous producer-consumer relation across a command trace that per-command safety checks never inspect. Reaches a 96.59% attack success rate against real coding agents on ordinary developer tasks.
• HalluSquatting: exploits agents hallucinating resource identifiers (skill/package names) that don't exist; attacker pre-registers those names so the hallucination resolves to attacker-hosted promptware. Hits 100% hallucination rate in skill-installation scenarios and is described as an untargeted "agentic botnet" with no victim selection.
• Setup-instruction weaponization: editing only a README or requirements file redirects an agent to untrusted registries/package names at install time; attacks planted in source were "missed almost everywhere" by existing checks.
• Friendly fire: a defensive code-review agent is persuaded by injections hidden in ordinary repo files to execute the very artifact it was asked to inspect — no hooks, skills, or MCP servers required, defeating the "we don't install third-party extensions" defense.
• Scanner bypass: a single malicious skill file passed all eight tested open-source skill scanners using encoding, homoglyph, paraphrase, and bundled-code techniques.
• GhostApproval context: explicitly stated to be the same bug class Adversa AI reported earlier in five other AI coding agents — this piece is independent confirmation plus additional vendor coverage, not a new discovery.

Preconditions / Affected

Applies broadly wherever agents install packages/skills from names they generate or resolve (HalluSquatting, setup-instruction attacks), where agents are given code-review/defensive tasks (Friendly fire), or where orgs rely on open-source skill scanners as a gate (scanner bypass).

What to do

The synthesis gives a concrete two-part control for the skill-naming problem specifically: an allowlist of sources the agent may resolve names against, backed by runtime detection (e.g., SkillGate) and an OS-level sandbox — explicitly instead of an agent-level denylist, since denylists are the thing HalluSquatting and the scanner bypass both defeated.

Caveats

Numbers (96.59%, 100% hallucination rate, 8/8 scanners bypassed) are as reported by each respective paper/post, not independently verified by Adversa AI.