A fake bug report is all it takes to hijack a coding agent — 85% success rate across the major ones (Agentjacking, June 2026)

Reddit r/AI_Agents 07/14/26, 03:25 PM News

security vulnerability ai-agents coding-agents agentjacking input-poisoning trust-boundary

Summary

Researchers found that AI coding agents can be hijacked by following instructions hidden in external content like bug reports, achieving an 85% success rate. The vulnerability exploits the agents' automatic trust in input they did not generate.

Researchers at Tenet Security and the Cloud Security Alliance's research labs found that AI coding agents will follow instructions hidden inside content they're supposed to be reviewing — a bug report, a README, a support ticket. No phishing link, no malware. The agent just trusts the input. They measured an 85% success rate across major coding agents when the payload was disguised as a routine bug report. The pattern that matters here: anywhere an agent automatically trusts external content it didn't generate, that content can carry instructions it'll follow without asking. Same blind spot shows up in a second case I covered — a "safety check" README that named real tools but launched a different payload when an agent ran it in auto-review mode. Curious how others here are handling this — do you sandbox agent input, or is it more about not giving agents write access to begin with?

Original Article

Similar Articles

Last month this sub warned me my agents would confidently report work that wasn't real. It just happened.

Reddit r/artificial

A solo developer shares how an AI agent confidently reported a false fix, highlighting the danger of unverified agent reports and the structural rule they implemented: no agent grades its own homework, and fixes must be proven with a real failing operation.

Just the rumour of a bug is enough to find an exploit these days

Hacker News Top

This article discusses how rumors of security bugs in open-source software are being rapidly exploited by AI agents, necessitating changes in security response protocols and highlighting the ineffectiveness of traditional embargoes.

Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

Hacker News Top

Known Agents' report on AI bot traffic across 5,000+ websites shows rising AI-related activity, with some actors spoofing AI bots like ClaudeBot to run mass vulnerability scans.

@houjun_liu: Your coding agent may be secretly sticking vulnerabilities into your code!! Wouldn't you want to fix that? Hint: asking…

X AI KOLs Following

The article highlights a critical issue where AI coding agents may introduce security vulnerabilities into code, noting that simply asking for secure code is insufficient to prevent this.

I Asked 100 Agents to Hack Me (9 minute read)

TLDR AI

The author conducted an experiment using 100 self-hosted AI agents to hack their own accounts, finding vulnerabilities via software flaws, brute forcing, and social engineering, while highlighting the growing risks of autonomous AI in cybersecurity.