AI Security
Study finds security misconfigurations in nearly 1 in 6 AI coding agent repositories
Researchers examining 3,100+ public GitHub repositories discovered widespread configuration vulnerabilities in AI agent setups, from unpinned dependencies to overly broad execution permissions.
Security researchers analyzing public GitHub repositories have uncovered a range of configuration problems in AI coding agents that could expose systems to risks during deployment. The findings underscore how the software supply chain for intelligent agents requires careful attention to how permissions and dependencies are declared.
The Study Scope#
A team examined over 3,100 public GitHub repositories hosting AI agent configurations, including roughly 2,660 assembled setups and 511 skill collections. The researchers applied multiple verification techniques—including deterministic analysis, mechanical re-derivation, and model-assisted review—to identify security and conformance issues across six distinct problem categories.
Key Vulnerability Findings#
The audit uncovered several concrete weaknesses in how agent configurations are managed:
- Unpinned dependencies: Nearly 1 in 10 setups (9.8%) failed to specify exact versions for Model Context Protocol (MCP) packages, leaving agents vulnerable to unexpected updates.
- Broad execution grants: About 2.5% of setups granted overly permissive execution authority that could allow unintended code execution.
- Excessive skill preapproval: Another 3.8% granted tools within skills automatic approval without proper review.
When combined, these three categories alone affected over 409 setups—representing 15.4% of all configurations examined. Among repositories that included MCP configuration, the problem was even more acute: nearly a quarter (24.5%) contained unpinned declarations.
Broader Conformance Issues#
Beyond the primary vulnerability categories, researchers identified additional problems with required fields and skill format compliance. Including these issues brought the overall affected setup rate to 17.9% and the skill collection rate to 6.8%.
Implications for Supply Chain Security#
The study reveals concrete opportunities for improving agent configuration practices: pinning all dependencies to specific versions, auditing execution permissions before deployment, and validating component conformance before distribution. However, the researchers note that actual runtime harm and the accuracy of detection methods against human assessment remain unresolved questions requiring further investigation.
