Topic starter
06/11/2026 6:37 pm
TL;DR: Recent Claude Code, Copilot CLI, opencode and Visual Studio cases all exploited trust boundaries in agent runtimes, config files or session spawning rather than the model itself, according to Adversa AI. The control problem is no longer just prompt injection; it is where an agent can write, launch, inherit or relay authority without a fresh decision gate.
Editorial analysis by NHI Mgmt Group, based on content published by Adversa AI: “Top AI coding agent security resources â November 2026”.
Key questions
Q: What should teams do first when a coding agent can reach local secrets or config files?
A: Start by removing the agent’s access to local secrets and config files, or isolating them behind a tighter execution path where the agent can read only what it needs.
Q: Why do child sessions and hooks create a security risk in agentic coding tools?
A: Child sessions and hooks can create a security risk because they run in a different trust context from the main agent, often with inherited permissions or automatic execution.
Q: How should security teams govern MCP tool access in enterprise environments?
A: Security teams should bind MCP tool access to enterprise identities, entitlements, and lifecycle state before a request reaches production tools.
Practitioner guidance
- Audit agent trust boundaries by path, not by product Map every place a coding agent can start, restart, spawn a child session, load hooks or inherit repository trust.
- Treat agent configuration as privileged state Inventory settings files, MCP definitions, sandbox flags, relay endpoints and environment variables that can change agent authority.
- Move enforcement outside the agent runtime Use network, identity and host controls that do not depend on the model or its own harness to behave correctly.
Bottom line: Recent coding-agent incidents show that the real weakness is often the execution path around the model, not the model output itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Runtime trust, not model safety, is the primary control problem in coding agents: these incidents show that the decisive boundary is where text becomes action. A safe prompt does not matter if the agent can write its own settings, launch a child session or execute through a relay that was never re-authorised. Practitioners need to treat agent execution paths as identity-bearing infrastructure, not just application behaviour.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between prompt injection and runtime trust abuse in coding agents?
A: Prompt injection is malicious input that tries to steer the agent’s behaviour, usually through prompts, files, or web content. Runtime trust abuse happens when the agent already has excessive authority and an attacker exploits that trust at execution time, such as through tool access, child processes, or over-broad secrets exposure. One attacks instructions, the other exploits delegated runtime privilege.
👉 Read our full editorial: Agentic coding agent controls fail when trust shifts at runtime