The 2026 security incidents

2026 made clear that an agent's execution environment and its tooling are a genuine attack surface. The incidents the guide catalogs are worth knowing because each one teaches a control:

• Project files as an execution vector (Check Point, 2025): repository files could be turned into execution material on the CLI, breaking the expected boundary. Lesson: treat anything checked into a repo an agent runs in as potentially executable.
• Command injection via branch names (March 2026, patched): a malicious GitHub branch name carried a hidden subshell (even disguised to look like main using Unicode) and could exfiltrate a victim's OAuth token in cleartext, across website, CLI, SDK, and IDE. Classified critical. Lesson: scope repository permissions tightly and isolate secrets from anything the agent can read.
• Supply-chain attacks: a malicious npm package masquerading as a Codex utility harvested auth tokens; the Axios compromise forced macOS signing-cert rotation. Lesson, echoing Snyk's "agentic supply chain" warning from Chapter 13: MCP servers, skills, and templates are privileged dependencies, and most organizations lack an inventory of what their AI tools can access.

The recurring theme: human review is not optional, and an agent must be treated as a privileged identity, scoped, secret-isolated, inventoried, and monitored, the same way you treat a human with the same access. Notably, the agent is part of both the attack surface and the defense: Codex Security, a dedicated agent, builds a threat model of a repo and hunts vulnerabilities, scanning over a million commits in beta. The Chapter 13 lesson scales: agents help find problems, but independent validation and human review still gate the fix.