Over the last few weeks we collected the confirmed security incidents involving AI coding agents, agents in CI and MCP servers that we could find, going back to July 2025. A case only went in if the affected company, the vendor, an official advisory or a research team confirmed it. That left 20 incidents, plus 12 research disclosures nobody has seen exploited.

What stood out for security teams:

The agent was rarely the entry point. 13 of the 20 started with something a developer installed: an npm or PyPI package, an MCP server, an agent skill, an editor extension. Shai-Hulud 2.0 hit official MCP server packages. The LiteLLM releases on PyPI were backdoored after a compromised scanner leaked the publish token.

Agent tokens are now on infostealer shopping lists. Families like Amatera, Remus and CallbackBeaver collect coding-agent tokens, MCP configs and prompt histories alongside browser data.…