What happened
On 27 Oct 2026 CSA published an analysis (author from Akto) arguing that AI coding agents on developer endpoints run as the developer, hold the developer's credentials, and take instructions from whatever they read — making the CLI/IDE a new attack surface. It details indirect prompt injection (e.g. CurXecute CVE-2025-54135, a compromised Amazon Q extension), the limits of point-in-time approval (auto-updating extensions, MCP servers fetching latest packages, the postmark-mcp 15-clean-versions-before-malicious case), and the gap in third-party AI risk review (82% of enterprises have unknown AI agents; 53% have seen agents exceed permissions). It proposes a governance model: inventory every agent/extension/skill/MCP server, run an approved MCP registry with pinning, apply least agency per OWASP agentic guidance, guardrail prompts and tool calls, move secrets to a vault, treat rules files/config as code, log every tool call, and name a single owner.
Why it matters
This surfaces an under-observed agentic attack surface — AI coding agents and their extension/MCP ecosystem — and the failure mode of point-in-time third-party review, which most vendor risk programs do not cover. It provides practical, OWASP-aligned governance controls for organisations rolling out AI coding assistants at scale.
Action needed
Extend third-party AI risk review to agent extensions, skills and MCP servers; implement approved/pinned MCP registries and least-agency permissions for coding agents; log and monitor every tool call and treat prompt/files as untrusted input.