AI Coding Tools Security: Agent Flaws Outpace Code-Review Fixes

Most of the risk has moved into the agent itself

For two years, the main worry about AI coding assistants was the code they wrote. In 2026 that is still a problem, but it is no longer the biggest one. The tools now run with shell, file and network access on developers' machines, and that access has become the main way attackers get in. Every major assistant has had a serious flaw disclosed this year: Claude Code, GitHub Copilot, Cursor and OpenAI's Codex. Many of those flaws let an attacker run code before the user saw an approval prompt.

The vendors have answered with more AI. Anthropic and GitHub have both spent the year turning automated security review into a product. My reading of the evidence is that these review tools help, but they are mostly aimed at the older problem. The newer problem is a trust-boundary problem, and no vendor has solved it.

The code quality problem has barely improved

The research mostly agrees on one thing: AI models now write working code far more reliably than they write secure code. Veracode's 2026 GenAI Code Security Report found that about 44% of tested generation tasks produced a known vulnerability. Its average security pass rate across models was 56%, almost unchanged from 55% in the previous edition.4 The weak spots are specific. Models passed SQL injection tests 83% of the time but cross-site scripting only 15% and log injection only 12%.4

One red-team result makes the gap concrete. On a benchmark built from 186 real Python CVEs rewritten as feature requests, Claude Opus 5.5 passed the functional tests on 93.5% of tasks. Only 54.8% of its solutions were both working and secure, and 41% of the working ones brought back the original vulnerability.2

The exact numbers vary a lot by source. Kusari cites Cloud Security Alliance and Endor Labs research finding design flaws or known vulnerabilities in 62% of AI-generated code.1 Cycode reports logic flaws at a similar rate in output from advanced reasoning models, and says traditional static analysis tools miss them.10 Lower-quality roundups give much smaller per-tool flaw rates without clear methods.6 The safest conclusion is that roughly half of AI-generated code fails security checks, and the share is not shrinking as fast as the amount of AI-written code is growing.

There are also problems that only exist because of AI. "Slopsquatting" means registering malicious packages under names that models tend to invent. It works because many invented package names come up again and again.1 The Cloud Security Alliance says GitGuardian found AI-assisted commits leak secrets at more than twice the normal rate, with over 24,000 unique secrets exposed in MCP configuration files alone.5

The repository has become the exploit

The harness is the software that wraps the model: config files, hooks, plugins, sandboxes and approval dialogs. That layer is where most of this year's serious attacks happened. Adversa AI's October roundup makes the point plainly: September's attacks rarely touched the model at all.2 The GitSpawn research found eight flaws across seven coding agents, including Claude Code, Codex and Cursor. A booby-trapped git setting such as core.fsmonitor ran attacker code whenever the agent called git, outside both the sandbox and the approval flow. Four of those flaws were still unpatched when the research was published.2 Plugin4Shell showed that Claude Code, Codex, GitHub Copilot and Gemini CLI installed pinned plugin commits without checking them. That let a malicious branch replace legitimate code during automatic updates.2 NeuralTrust reports that Anthropic fixed Plugin4Shell in Claude Code 2.1.179.16

Cursor has had an especially hard year. Cato Networks' "DuneSlide" flaws, CVE-2026-50548 and CVE-2026-50549, are both rated 9.8. They let a prompt injection carried in ordinary content, such as an MCP response or a web search result, overwrite Cursor's own sandbox helper and then run commands with no restrictions.2126 Both were patched in Cursor 3.0, and every earlier version was affected.26 Before that came CVE-2026-26268, where a pre-commit hook hidden in a nested bare repository fired when the agent ran a routine git command.2228 Cursor 3.0.0 also fixed CVE-2026-48124. That bug let Cursor run hook commands defined in a workspace's .claude/settings.local.json file without asking the user.24

Claude Code's list is about as long. Check Point disclosed CVE-2026-21852: a malicious ANTHROPIC_BASE_URL value in project config could capture a user's plaintext API key before any trust dialog appeared.58 NeuralTrust tracks a string of later fixes for issues in the GitHub Action, deeplinks and git config, up to version 2.1.196.16 Some of these will never get a patch. In one attack, a repository's subagent config led Claude Code to run a command-and-control payload. Anthropic called that behavior by design.2 Adversa counts ten documented Claude Code attacks. Only two received CVEs, and vendors declined four.216

Coverage of these flaws agrees on the facts. Where it differs is on what it means. Trade outlets generally present each disclosure as a bug that has been patched.2627 Security researchers present the pattern as structural. Their argument is that any file an agent reads automatically when it opens a folder should be treated like executable input.23 I think the researchers are right. Each fix closes one route in, while the underlying design stays the same.

Vendors respond with AI review

Anthropic has added several security layers to Claude Code. The /security-review command checks for injection, cross-site scripting, authentication flaws, insecure data handling and vulnerable dependencies.1113 In May it shipped a security-guidance plugin that checks code in three stages while Claude writes it. Anthropic says internal use cut security-related PR comments by 30–40%.18 Claude Security, the full-codebase scanner first previewed in February, entered public beta for Enterprise customers on May 1, according to NeuralTrust.16 Recent releases point the same way. They add an OpenTelemetry event for every blocked or prompted tool call and fix sandbox gaps where shell startup files ran outside the sandbox.19

GitHub has gone further. In March, Copilot code review moved to an agentic architecture that runs on GitHub Actions.34 Later updates added support for AGENTS.md files, agent skills and MCP servers, with MCP calls limited to read-only.3531 In August GitHub removed the old limit on how large a pull request it could review.32 Agentic autofix became generally available on October 15. It reruns CodeQL to confirm that a proposed fix actually resolves the alert before opening a draft pull request.36 On October 28, GitHub previewed Copilot code review Max, which combines review agents running models from different providers.36

The trust question nobody can automate

The GitHub change that matters most is about authority, not quality. Copilot approvals, now generally available, can count toward a repository's required approvals. They are off by default, administrators can limit them to certain file paths, and any new commit cancels the approval.3638 Guidance from August still described Copilot reviews as comment-only, which shows how fast this has moved.39

One analysis points out a circular risk. Copilot reads its instructions and skills from the pull request's head branch, so a pull request could change the rules used to judge it.38 Anthropic's own GitHub Action has a similar caveat. Its README says it is not hardened against prompt injection and should only review trusted pull requests.13

The two problems connect here. AI reviewers read text that attackers control, which is exactly the input the harness research shows agents cannot reliably resist. The CSA reports that published prompt-injection defenses were bypassed more than 85% of the time under adaptive attacks.5

Cost is also changing. Since June 1, each Copilot code review uses AI Credits plus Actions minutes on private repositories.33 At the same time, GitHub says AI agents now open more than 40% of pull requests.36 As agent-written code grows, AI review is becoming a billed checkpoint, and teams are being asked to trust it.

What this means

Speed is no longer what separates these tools. The useful questions are what an agent can reach, and what runs before a human approves anything. The practical steps for organizations are already clear:

• Open untrusted repositories in disposable containers.
• Review .git/config, hook files and agent config files the way you would review build scripts.
• Set minimum tool versions.
• Turn off automatic plugin updates until commits are verified.216

AI code review is worth using as a first pass. It should not be the only gate, and it is not a substitute for a human approver. GitHub itself warns that Copilot will not catch every problem.38