AI Coding Agents Under Attack: Plugin4Shell, MCP Flaws and How to Protect Developers

Why AI coding agents became a target

AI coding agents are assistants that write code for developers. They read your code, run commands and install tools. They often hold cloud passwords and access tokens. That makes them attractive targets. A single bad file in a repository (a shared code project), or a poisoned plugin, can turn the agent against you. It then works for the attacker from inside a developer's computer.

Most of the 2026 findings share one root cause: the agent treats untrusted content as trusted instructions. That is prompt injection (hiding orders for an AI inside text it reads), with real tools attached.

What was found in 2026

The table lists the main flaws by month, with fixed versions for your developers. Many involve MCP, the Model Context Protocol, a standard way to plug extra tools into an AI assistant. Each tool runs as an MCP server.

Several of these needed nothing more than a developer opening the wrong repository.

The common patterns

• Project files as instructions: settings files, guidance notes and git settings in a downloaded project were run or obeyed. This happened before the user had said they trust the project.
• Auto-updating plugins and tools: once a plugin source is hacked, every machine that updates is hacked too.
• MCP servers with too much power: add-on tools that can run commands or write files, connected without review.
• Passwords and keys within reach: cloud keys, GitHub tokens and SSH keys that the agent can read.

What to change this week

1. Update every AI coding tool and code editor (IDE) your team uses, and turn on auto-update for security fixes.
2. Require a yes before the agent runs commands, at least for anything outside the project folder or that touches the network.
3. Open unknown projects in a sandbox (a separate container or virtual machine without your real passwords), not on your main computer.
4. Approve MCP servers and plugins by name. Review what each one can do, lock it to a set version, and remove the ones nobody uses.
5. Keep long-lived secrets off developer laptops. Use cloud keys that expire quickly and a secrets manager (a secure vault for keys).
6. Log agent actions so you can investigate if something goes wrong.

What this means for products with AI features

The same weak spots appear in AI that customers use. Think of support bots that call internal APIs (links that let one system talk to another). Or assistants that read email, and agents that take actions in your app. In August, OWASP released a 2026 edition of its Top 10 for LLM Applications. An LLM is the kind of AI model behind chat assistants. The AICPA, which sets the rules for SOC 2 security reports, has also proposed adding AI points of focus to SOC 2 (see our summary). Expect customers and auditors to ask how your AI features are tested.

Our AI red teaming service tests chatbots, agents and MCP links against these attacks.