Topic
Security of the tools developers build with: package registries, dev servers, coding agents and their configs, and the credentials they can reach.
OpenCode, Copilot CLI and Claude Code read instruction files meant for other agents, a dev.to guide reports. A rule can load from a file you never edited, or not load at all, so the loaded-file list comes before any prompt rewrite.
Reality
ReversingLabs found tw-pkgprobe-7731 claiming to be an authorized Twilio HackerOne research probe while it tried to exfiltrate data, and its 2026 count of malicious npm packages passed all of 2024 by the end of August.
Reality
F5 Labs logged more than 800 attacks and about 32,000 raw events against its honeypots in a month, using an April bypass of Vite's server.fs.deny to read .env files, cloud credentials and terraform.tfstate.
Perspective Coverage
3 publishersReality
Manifold Security's GitSpawn findings cover eight issues across seven coding agents. The path runs through core.fsmonitor, where a background git status starts a helper the repository chose, outside the agent's sandbox and with no prompt.
Reality
Seatbelt on macOS and bubblewrap on Linux now stop the agent's shell at the folder it was invoked in and route its traffic through a domain allowlist. That is a boundary a security team can approve once.
Reality