Safe coding with AI agents: vulnerabilities in agent-written code, poisoned skills and MCP servers, hallucinated and malicious packages, supply chain.
Agent security
We scanned 5,819 Claude skills from 115 repos and read every serious finding. 139 flagged, none malware. What gets a skill flagged, and 15 that passed.
CodexGuild Research9 min read
Agent security
PHP2Shell, the Railway and Zeabur breaches, litellm 1.107.0 and the OVHcloud CLI, all in one week of October 2026. Who is affected, what to patch, which secrets to rotate.
CodexGuild Research11 min read
Agent security
800+ fake Skills and MCP servers got coding agents to relay malware install steps. What happened, what's left three months later, and rules for your agent.
CodexGuild Research6 min read
Agent security
litellm 1.107.0 on PyPI ran a credential stealer on every Python start, coding-agent configs included. How to check without triggering it, clean up and rotate.
CodexGuild Research7 min read