Your Coding Agents Are Now a Direct RCE Vector
Straiker's STAR Labs found 36% of successful coding agent attacks achieve remote code execution on developer machines holding source code and cloud keys. MCP ecosystem unvetted.
#security
2 posts
CI/CD Workflows Just Leaked Secrets to Untrusted Prompts
Microsoft found Claude Code's GitHub Action exposes runner secrets via the Read tool. Here's the exact attack path and how to lock it down.