1. Cloud Security Alliance Oct 21, 2026
   

   News

   The Cloud Security Alliance describes the security risks of coding agents on developers' machines.

   • According to the Cloud Security Alliance, 82% of companies host unlisted AI agents in their environments.

   • In CurXecute (CVE-2025-54135), a Slack message to summarize rewrote Cursor's MCP configuration and executed code.

   • Version 1.0.16 of the postmark-mcp package blind-copied every email sent by the agent to a third party.

   • A research note lists exploitable CVEs in GitHub Copilot, Cursor, OpenAI Codex CLI and Claude Code.

   Read the original article Your CLI and IDE Are the New Attack Surface: Governing AI Coding Agents on the Endpoint cloudsecurityalliance.org

Back to the weekBack to the month