A preprint scan of 3,171 repositories finds 16% of AI coding-agent setups carry a security defect, with 9.8% installing unpinned MCP servers that run with your privileges.
A preprint submitted to arXiv on September 7, 2026, "Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations," scanned 3,171 public GitHub repositories and found a security defect in 16.0% of the agent setups it examined, with 16.7% carrying a confirmed defect of any kind. The corpus covers Claude Code, Cursor, GitHub Copilot and OpenAI Codex. It carries no peer review.
The breakdown is where the work is. 2,660 setups assemble two or more component types, 511 are published skill collections. 9.8% of setups pin no version on the MCP server they install. 3.1% ship a scoped-looking grant that actually pre-approves arbitrary execution, and 3.8% ship a skill that pre-approves the shell for anyone who installs it.
That is a dependency layer with no lockfile and no install-time check, and it runs with your privileges as soon as you install it. One methodological finding deserves repeating: the raw scanner flagged 25.5% on the same rules, so unaudited analyzer output inflates findings by a wide margin, and the paper found no confirmed credential-exfiltration path.
Grep your repositories for an unpinned npx -y @scope/server-name in MCP declarations and pin the version, then audit any skill or hook that pre-approves shell commands for whoever installs it. Treat a rate from a raw analyzer as a property of the analyzer until someone re-derives the findings.
Google announced WebMCP, an open standard turning websites into agent toolkits, and built-in Gemini Nano in Chrome for on-device AI. Here's what the agentic web means for how we build and how users interact with our applications.
1 source
AI-generated code gets higher marks than human code during review, but 82% of orgs hit production failures from it, 86% of senior devs spend more time fixing it, and a new term is born: agent debt.
2 sources
Wiz's autonomous Red Agent exploited a GitHub Actions script-injection flaw in Snowflake's repo and exfiltrated credentials, proof that AI can weaponize CI bugs and that co-author metadata can't pin the blame.
1 source