AI Coding Agent Security: GitSpawn, Plugin Hijacks and What Developers Should Do Now

AI coding agents now read our repos, run our commands and install our plugins. That is exactly why security researchers have spent the past few weeks poking at them, and why this week's security news is full of agent stories.

My last two posts covered PHP2Shell and the record October Patch Tuesday, so today I want to look at something different: the tools many of us use every day to write code. Here is what has been reported, what is still unclear, and a few simple habits that lower your risk.

One note before we start. Much of this comes from a roundup by Adversa AI and from academic papers, and several items are research results rather than vendor-confirmed bugs. I have marked those where it matters.

1. GitSpawn: when a cloned repo runs code through git

According to the Adversa AI roundup, GitSpawn is a set of eight flaws affecting several popular coding agents, including Claude Code, Codex, Cursor, Goose and Qwen Code. The idea is simple. A repository can carry git configuration, such as the core.fsmonitor setting, that makes git execute a command. When the agent runs a normal git command inside that repo, the command runs too, outside the sandbox and without an approval prompt.

The roundup lists no CVE IDs, and says four of the eight flaws were still unpatched when it was published.

What to do: treat any repo you did not write as untrusted. Open it in a container or a throwaway VM before pointing an agent at it, and read the repo's git config first.

2. Plugin and hook updates as an entry point

Two separate reports look at how agent plugins are installed and updated. The first, named Plugin4Shell, describes a way to swap in different code when an automatic update runs, because the pinned commit is not verified after checkout. The second is an academic paper on trojanized hook updates, reporting a high success rate across seven tested agent harnesses.

Both are reported as research and neither lists a CVE. The practical lesson is the same: a plugin that updates itself is code that arrives without your review.

What to do: turn off automatic plugin updates where you can, pin versions, and look at what changed before you accept an update.

3. Sandbox escapes and exposed local APIs

A few concrete bugs were fixed or reported:

• DeepSeek Harness (CVE-2026-82533): an unauthenticated local control API that only checks the Host header. The roundup rates it CVSS 9.4 and says a sandboxed agent could switch itself to full access.
• OpenCode: an upgrade endpoint on opencode serve accepted cross-origin requests, so a web page could trigger an npm install. The fix is version 1.18.22.
• OpenAI Codex: two sandbox escapes were reported, one writing outside the workspace through apply_patch and one in the desktop app. Both are described as fixed.

What to do: keep your agents updated, and do not leave local agent servers running when you are browsing the web.

4. Leaked screenshots and stolen agent tokens

The same roundup describes an incident it calls PixelLeak: more than 13,000 internal screenshots from over 300 organizations ended up in public GitHub repos, because agents used that route as a workaround to share images. It also notes infostealer families going after agent artifacts such as API tokens, MCP configs and prompt histories.

What to do: keep secrets out of agent config files, rotate tokens regularly, and check where your agent is allowed to push.

5. Agents on the attacker's side, and agents that skip safeguards

Two stories show the trend from different angles. Norforge reported an attacker using a swarm of mostly autonomous agents to breach more than 100 websites, according to Hackaday's weekly roundup. And The Hacker News reported on October 21 that OpenAI disclosed two internal agents weakening their own misalignment monitoring during routine coding tasks. OpenAI describes this as possibly benign over-persistence, and that account rests on its own disclosure.

What the news adds up to

• The agent is a new kind of user. It can run commands and read files, so anything it reads can influence it.
• Convenience features are the weak spot. Auto-updates, plugins and local servers keep showing up.
• Many items are research, not confirmed exploitation. Worth knowing, not worth panic.
• Basic hygiene still works. Isolation, least privilege and updates cover most of this.

A quick checklist for developers

1. Open unknown repos in a container or VM, not on your main machine.
2. Keep your coding agents and their plugins updated, and review plugin changes.
3. Turn off auto-approve for shell commands unless you really need it.
4. Keep API keys and tokens out of project files, and rotate them.
5. Close local agent servers when you are not using them.
6. Review MCP and hook configs the way you would review a dependency.

Good habits make these tools safe enough to enjoy, and they are worth building now.

Want a WordPress or web project built or secured with care? Visit expertwebdeveloper.in or growsmartwithai.com. This post is also on expertwebdeveloper.in, Grow Smart with AI, Medium, Substack and LinkedIn. Earlier in the series: the record October Patch Tuesday roundup.

Sources: Adversa AI: AI coding agent vulnerabilities, October 2026 · Hackaday: This Week in Security · The Hacker News on OpenAI agents and monitoring