Auditing AI Coding Agents: Untrusted Content In, Tool Calls Out
Agentic coding tools ingest untrusted text, including cloned READMEs, setup.txt files, dependency docs and issue comments, into the same context channel as your instructions. This short walks the chain the October 2026 reporting implies: delivery from a poisoned repo or text file, ingestion with no boundary between data and instructions, the client-side tool call that actually executes, and the developer shell the agent inherits. What the reporting establishes, and what it doesn't. Sophos research, summarized by Cyber Press, describes ransomware operators using AI agents to get past controls and reach domain admin. CyberSecurityNews named Cursor and the Aur0ra crew; the crew name came from a single outlet. Hackread covered a fake GitHub repository that tricks agents into installing SolanaCry, and Mashable covered malicious text files aimed at coding agents. No CVE or vendor advisory appears in that coverage, so the framing isn't that the tool was broken. It was pointed at text that told it what to do, inside a session that could already do those things. The structural failure is that retrieved content and operator intent share one channel. Prompt-level defenses, such as telling the model to ignore instructions found in files, are a wish rather than a control. What holds is taking away the agent's ability to do damage when it obeys: deny tool calls by default, require approval and log every shell, file-write and package-install call, and run the agent in a container with no network, no capabilities and an empty environment, because exported tokens are readable from inside the process tree. Adding an MCP server deserves the same treatment as installing a package: pin it, review it, sandbox it, log its calls. The walkthrough covers the lab harness, the captured tool calls and the per-call checks worth having in place before an agent touches a repository you care about: https://hackyjs.com/posts/auditing-ai-coding-agents-for-untrusted-content-ingestion-and-per-tool-call-abuse