Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors conduct an empirical security audit of AI coding-agent harnesses across 3,171 public GitHub repositories using a byte-level static scanner combined with multi-model adjudication. Because agent configurations run with full developer privileges but lack basic package-management primitives like lockfiles or permission boundaries, they represent an unmonitored software supply chain. They find that 16.0% of multi-component setups contain confirmed security defects, including unpinned Model Context Protocol (MCP) servers (9.8%), arbitrary shell execution masked by faux-scoped grants (3.1%), and third-party skills that pre-approve shell access for downstream users (3.8%).
Over 16% of AI coding-agent configurations silently expose developer environments to supply-chain compromise, frequently disguising arbitrary shell execution behind faux-scoped permissions or consuming unpinned MCP servers.
AI coding agents such as Claude Code, Cursor, GitHub Copilot, and OpenAI Codex are configured through artifacts developers write and share: instruction files, skills, hooks, MCP server declarations, subagents. This harness is a dependency layer installed from marketplaces and public repositories, running with the developer's privileges, with no lockfile, no install-time check, and no vocabulary for what a component may do. We study it over 3,171 public GitHub repositories: 2,660 setups that assemble two or more component types and 511 published skill collections. We measure only rules decidable from bytes whose consequence is a security exposure, a configuration that cannot work, or a departure from the Agent Skills specification, and validate every finding before it counts: an independent implementation re-derives it from the repository at its pinned commit, a language-model adjudicator with a released prompt rules on every disagreement, and a second independent model session re-checks every counted pair. Three security classes survive: 9.8% of setups install an MCP server with no version pinned, 3.1% pre-approve arbitrary execution behind a scoped-looking grant such as Bash(python:*), and 3.8% carry a skill that pre-approves the shell for whoever installs it. In total 16.0% of setups carry a security defect and 16.7% a confirmed defect of any kind, against a raw scanner rate of 25.5% on the same rules; the third class ships inside 3.7% of collections, where a marketplace scan can see it. Rules that compare two files detect differences that are usually intended and are reported as observations. No credential-exfiltration path was confirmed. The instrument, corpus manifest, prompt, and every verdict are released.