Coding agent security in 2026 — why prompts cannot stop prompt injection

Executive summary

The moment you connect tools to a coding agent, your laptop becomes an attack surface. In 2026 this is not a thought experiment but a class of vulnerabilities registered as real CVEs (public vulnerability identifiers). And this is not the kind of problem you solve by writing a better prompt — you have to change the permission structure.

What changed in 2026

In its 2025 edition, OWASP's State of Agentic AI Security and Governance covered “plausible threats.” The 2026 edition (v2.01) puts CVE numbers, vendor security advisories and breach reports in their place. The document moved from prediction to record.

What stands out in that record is which projects it covers. Of the 53 agentic projects tracked, 28 were coding agents, and these are the repositories with the most security advisories:

Why this is structurally hard to prevent

The cause is not model quality but the structure of the input. An LLM receives the system prompt, the user's request, and text fetched from outside as a single sequence of tokens — one input stream that the model processes together. As Simon Willison puts it, “LLMs are unable to reliably distinguish the importance of instructions based on where they came from.”

3.1 The lethal trifecta

When the three elements Willison identified are all present in one agent at the same time, that agent becomes a data exfiltration tool. OWASP's 2026 edition adopts this rule of thumb as well.

3.2 Meta's Rule of Two

Meta framed the same problem from a different angle: an autonomous agent should be allowed at most two of the three properties. If it must have all three, human oversight has to be added from that point on. The trifecta describes when the risk exists; the Rule of Two tells you which of the three to remove.

What actually happened

In the first 60 days of 2026, more than 30 CVEs (identifiers for publicly disclosed vulnerabilities) related to MCP (Model Context Protocol, the standard way agents attach external tools) were filed, and about 43% of them were command injection. The table below includes only cases that differ from one another in attack method and impact. CVSS is a severity score out of 10.

4.1 Supply chain: postmark-mcp

This was the quietest incident. An npm package called postmark-mcp first shipped several clean versions to build trust, then added a single line around 1.0.16: code that silently BCC'd every email the agent processed to an external domain. Snyk found it on September 25, 2025, and it is on record as the first tracked malicious-MCP-server supply-chain incident. How far package provenance attestation can stand in for this kind of review is covered separately in Supply chain security for AI coding tools.

4.2 Tool poisoning

This is at the center of the set of cases Microsoft published in June 2026. The attacker edits an MCP tool's description to plant instructions. The user sees only the tool's name; the model reads the whole description. If the approval step only asks whether to add a new tool, nobody checks when the description of an already-approved tool changes.

Microsoft's advice is clear: “Review metadata changes to production tools with the same rigor as changes to system prompts.”

How much attack surface is exposed

What is scarier than any single vulnerability is the state of default configurations. The figures below each come from a different research organization, listed with its source.

In Trend Micro's first survey, the 492 exposed servers had 1,402 tools attached, and more than 90% of those tools allowed data to be read directly. 74% of the servers ran on AWS, Azure, GCP or Oracle. In other words, this is not about internal servers behind a firewall.

Defenses that do not work on their own

This does not mean the three below are useless — it means they are not enough on their own. Each has value as one layer of defense in depth. The problem is a design that makes one of them the main defense.

What actually works

They have one thing in common: they do not trust the model's judgment; they shrink what the model can reach.

Korea: where the AI Basic Act overlaps

Korea's AI Basic Act (인공지능 발전과 신뢰 기반 조성 등에 관한 기본법, literally the Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust) took effect on January 22, 2026. Some of its provisions overlap directly with agent security design. The summary below is based on the statute's text (Articles 34, 35 and 43), which we checked.

The measures in the previous section map onto this directly. Tool permission layout and approval gates are the risk management plan, human approval for high-impact actions is human management and oversight, and tool-call logs are the documents that show the measures taken. The regulation does not create new work so much as put a name on what you should already be doing and keep a record of it.

That said, whether a coding agent used as an internal development tool counts as “high-impact AI” is a separate question, and the answer depends on the nature of the service and the domain it is used in. This article is not legal advice. If you are putting an agent into a service offered to outside users, check the statute's text and the competent ministry's guidance yourself, and get advice where a judgment call is needed.

Checklist for one-person studios

For teams without a big-company security department, in order, starting with what you can do in 30 minutes today.

What this is not yet

• The figures in this article are not our own measurements. They summarize public material from JFrog, Snyk, Trend Micro, Astrix, HackerOne, Check Point, Oligo and OWASP. Many of them, however, reached us through a security vendor blog's secondary compilation, and we did not check each one against the original release. In particular, for “30 CVEs in 60 days, 43% of them command injection,” “437,000+ downloads,” and “78% false-positive rate,” this article could not provide a link to the original source. If you need to cite them, check with the original research organization.
• Scanner-based counts tend to overestimate. That is why we kept the 78% false-positive report in the body.
• The “repositories with the most advisories” list is not a risk ranking. It is a function of usage and attention.
• The Rule of Two and the trifecta are heuristics, not proofs. They are useful as practical design principles, but following them does not guarantee safety.
• This field changes quarter by quarter. The CVE list above is as of September 2026, and it will have grown by the time you read this.

Sources

This document is a technical summary of public material as of 2026-09-06. CVEs and patch status keep changing, so check each vendor's latest security advisories yourself before acting. Get legal advice where a legal judgment is needed.