Chainguard unveiled Harness, which has frontier models such as Claude Mythos 5.1 attack a live build and reports only flaws that reproduce. It arrived with Workspaces and Checks for coding agents and an expansion of Libraries to Go and .NET.
Perspective Coverage
4 publishers
- Builder
- Builder 32%
- Operator
- Operator 44%
- Investor
- Investor 24%
Reality
- Evidence35
- Adoption12
- Hype gap+30
- Incentives70
- Confidence70
buildOne report1 publisher npm worms ran attacker code from committed Claude Code hooks
Worms spreading through npm in May and June 2026 committed a SessionStart hook to .claude/settings.json that runs a script when Claude Code opens the repo. Removing the package leaves that file in place, a dev.to write-up says.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
buildConfirmed2 publishers Tensorlake's npm SDK 0.5.144 carried a Shai-Hulud worm on October 8 that steals GitHub and npm tokens, cloud keys and AI coding-tool configs. A dev.to write-up of StepSecurity's teardown says revoking the stolen GitHub token triggers an rm -rf ~/, so the service must go first.
Publishers:dev.to · endorlabs.com Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
buildOne report1 publisher Claude Code's deny rules missed an env-prefixed rm -rf in every 2.1.288 run
A dev.to tester ran TZ="$HOME" rm -rf build past a Claude Code 2.1.288 Bash(rm *) deny rule in 6 of 6 sandboxed runs. Version 2.1.289 stopped all six, but bash -c 'rm -rf build' still ran in 6 of 6 sandboxed runs on that build.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence65
buildOne report1 publisher Adversa AI hides instructions from Copilot CLI's guardrails inside ciphertext the agent decrypts itself
Adversa AI got GitHub Copilot CLI to decrypt and run a hidden instruction, and Microsoft's mai-code-1.1-flash fell for it 50 percent of the time. GitHub declined to treat it as a product vulnerability, so teams running autopilot have to check what the agent executes themselves.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher Four coding-agent CVEs trace to approval gates that parse commands differently from the shell
Four September 2026 CVEs in Codex CLI, Roo-Code, OpenClaw and Ollama came from approval gates that read commands differently from the shell. Ollama fixed its version by deleting the prefix parser, and gates that match exact strings and refuse unmodeled syntax close that gap by design.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence50
buildOne report1 publisher Claude Code's Read deny rules let grep -r and CLAUDE.md imports reach denied files
Claude Code 2.1.285's Read deny rules let 4 of 11 file-reading routes reach the model in a developer's test, among them grep -r and CLAUDE.md @imports. The docs limit the rules to named paths and point anyone needing a hard block to the OS sandbox.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence60
buildOne report1 publisher An SCP deny outranks the admin role a coding agent borrows in AWS member accounts
One SCP deny line blocked an AdministratorAccess session in a scratch AWS account, according to a dev.to guide to sandboxing coding agents. Its three gaps, the management account, service-linked roles and outside principals admitted by resource policies, set where an agent can run.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence40
Shai-Hulud's third wave printed SAP's npm token straight into a workflow log
Four core SAP build packages shipped an identical 11.6MB credential stealer. Because npm trusted the whole cap-js repository rather than one branch, a commit pushed to an unused branch was enough to publish them.
Publishers:stepsecurity.io
Reality
- Evidence60
- Adoption38
- Hype gap+15
- Incentives78
- Confidence55
buildOne report1 publisher Eighteen flagged agent packages still install from npm weeks after the feeds listed them
AgentGate read the shipped code behind 30-plus OSV and GHSA flags, verified 19 npm packages as malicious, and found 18 still resolvable on publication day. Removal, not detection, is where the chain stopped.
Reality
- Evidence48
- Adoption20
- Hype gap+22
- Incentives78
- Confidence55
One authorization flaw survives both plan and default mode across six agent-built apps
Datadog Security Labs put one document-portal prompt through three coding agents in both modes and audited all six builds. An insecure direct object reference appeared in each, and one build per cell leaves mode effects entangled with noise.
Publishers:securitylabs.datadoghq.com
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+12
- Incentives68
- Confidence45
buildOne report1 publisher Twenty-three security checks, zero coverage: AI coding agents as build-pipeline attack surface
Novee Security's Black Hat findings land the same lesson on three agents: a validator that inspects a cleaned-up copy of a command is not a control, and a sandbox built too late is not one either.
Reality
- Evidence42
- Adoption55
- Hype gap+27
- Incentives68
- Confidence45
A config file that runs shell commands: "open this in Claude Code" needs a review gate
Check Point found Claude Code project configs could execute commands and steal Anthropic API keys on clone. Anthropic has patched it. The trust model it exposed is still yours to manage.
Publishers:research.checkpoint.com
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence60
buildOne report1 publisher Your Coding Agent Reads .env, And .gitignore Was Never The Control
A dev.to writeup makes a point worth stealing: the secret leaves your machine in a prompt, not a commit. The proposed fix is a local proxy that masks values before egress.
Reality
- Evidence32
- Adoption
- Not scored
- Hype gap+12
- Incentives72
- Confidence40
The allowlist read the command name, not what the command would do
CVE-2026-22708 let injected text rewrite a Cursor agent's environment, so an approved "git branch" ran something else. It worked with an empty allowlist too.
Reality
- Evidence58
- Adoption45
- Hype gap+18
- Incentives78
- Confidence55
buildOne report1 publisher Decoys in the .env file: Jitpass bets on lying to your coding agent
A Mac utility replaces plaintext credentials with fake ones and injects the real value into an approved process after Touch ID. The pattern is now on every security team's evaluation list.
Reality
- Evidence36
- Adoption9
- Hype gap+28
- Incentives68
- Confidence38