News
The confirmed damage notably goes through extensions and project files that the agent trusts.
In October 2026, the Cursor marketplace distributed a booby-trapped Claude Code extension for about 11 hours.
At PocketOS, an agent deleted a production volume with a Railway token found in a file.
Workspace Trust is disabled by default, letting a .vscode/tasks.json task run when a folder is opened.
News
In late October 2026, almost no current client loaded these skills distributed by MCP.
The checks confirm the consistency of the files, but not the reliability of their instructions.
The specification requires the client to ask the user's consent before running code linked to a skill.
A local MCP server or a manipulated agent can already drop a skill into a trusted folder.
News
The NCSC's 2026 annual review lists 337 incidents that required its support.
In the incidents handled, no observed use of AI enabled a new category of attack.
The NCSC invites examining accessible data, tools, trusted instructions and control of actions.