Summary
Most published vulnerabilities in AI coding agents are not about the model. They are about what the tool trusted before anyone decided to trust it: configuration read before consent, approval checks that parse text differently from the shell, sandboxes with a seam. We built a dataset of every coding-agent and agentic-IDE CVE we could confirm on the National Vulnerability Database between 1 January 2025 and 26 October 2026.
The paper classifies 105 entries across 13 products by the boundary that failed, measures how many need no user interaction, and reports 43 more CVEs in the MCP servers, SDKs and bridges these agents connect to. It is a dataset of confirmed CVEs, not a census, and it does not rank vendors: the counts reflect what each vendor chose to register.
The numbers
- 105CVEs in coding agents and agentic IDEs, each confirmed on NVDNVD · 26 Oct 2026
- 63of 105 are configuration-trust or approval and sandbox failuresSection 03 · our classification
- 41of 105 need no user interaction in their CVSS vectorRQ2 · NVD CVSS
- 14score 9.0 or higher; 12 of them need no user interactionRQ2 · NVD CVSS
Key findings
- Trust was often asked after the work was done. Claude Code, OpenAI Codex CLI and Kiro each had entries where project files ran or were read before the trust prompt appeared, or where the prompt was skipped.
- Agents rewrote the files that govern them. Cursor, Zed, Windsurf and Kiro entries describe an injected agent creating or changing an MCP or project configuration file to gain code execution.
- Approval checks and the shell parsed text differently. Roo Code, Cursor, Claude Code and Kiro CLI entries turn on command text that an approval layer judged safe and the shell then ran differently.
- Two sandbox bypasses score 10.0. Both are Claude Code entries: a protected settings file that did not yet exist, and a symlink that the unsandboxed process followed.
- Fixes only help the devices that take them. One Cline entry was published with no public patch, and the other 104 depend on each device running the fixed version.
- The MCP layer fails like a network service, and one more way. 43 further CVEs cover command injection, missing authentication and path handling, plus tool descriptions that become the agent's instructions.
What is inside
- 01Summary
- 02Introduction and research questions
- 03Method and dataset
- 04RQ1 · Which boundary failed
- 05Five failure mechanisms
- 06RQ2 · How much needs a click
- 07RQ3 · The MCP layer
- 08Discussion: controls outside the agent
- 09Limitations and conclusion
- 10References and appendices