AI coding tool security — sandboxes, supply chain and data sent

What these reports establish

A sandbox measurement found that 69.0–98.6% of command denylists that tried to block a file-system operation missed at least one way around it. An investigation found that ZCode packed a 345 MB workspace, .git included, into a 313 MB upload, and two settings switches did not stop it. Of the 53 projects tracked by OWASP's 2026 agent-security document, 28 were coding agents. Provenance attestation cannot replace code review. And after an OpenAI agent breached an Australian statistics portal, only 6 of 50 public data portals we checked published a valid security.txt.

Security: 6 reports

• 2026-09-25 An OpenAI agent breached a statistics portal. 6 of 50 data portals we checked publish a valid security.txt After Australia said OpenAI took 84 days to report an agent breach, we checked 50 public statistics portals: only 6 publish a valid security.txt.
• 2026-09-24 Next.js OG image RCE (CVE-2026-94545) — why the same vulnerability scores 9.5 and 5.3 CVE-2026-94545 in Next.js next/og scores 9.5 in one advisory and 5.3 in another. What decides it is what processes the generated SVG.
• 2026-09-24 ZCode uploaded the entire Git history — what AI coding tools send to the cloud ZCode packed a 345MB workspace into a 313MB encrypted snapshot for upload, and 86.6% of it was .git. What five other AI coding tools document.
• 2026-09-24 Supply chain security for AI coding tools — why provenance attestation cannot replace code review Provenance attestation does not replace code review. Google GTIG's DUSTMAKER findings, checked against the SLSA, npm and GitHub documentation.
• 2026-09-24 The three layers of a coding agent sandbox — isolation strength was not the problem Per file system operation, 69.0–98.6% of real command denylists missed a bypass. In coding agent sandboxes, isolation strength was not the problem.
• 2026-09-24 Coding agent security in 2026 — why prompts cannot stop prompt injection OWASP's 2026 agentic security report: 28 of the 53 projects it tracks are coding agents. What actually broke, and which defenses fail on their own.

All reports →