Scanning the Harness: Configuration Exposures in AI Coding-Agent Supply Chains

Evidence record

Primary revised arXiv:2609.07360v3 paper by Benjamin Kapner, Carmel Soceanu, Alicia Petrunin and Hofni Gartner, dated September 25, 2026. Samples 3,171 public repositories; finds 409 of 2,660 assembled setups with selected unpinned dependencies or broad execution preapprovals. Explicitly qualifies nonrandom sampling, incomplete detection, client-specific permission semantics and no measured runtime compromise.

Read the original source ↗

Claim-level citations (9)

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The corrected September 25, 2026 v3 study examined 3,171 public repositories: 2,660 assembled coding-agent setups and 511 skill collections. The collection was discoverability-based, not a probability sample.

  Abstract; Sections 3.1 Corpus and Units of Analysis and 6 Selection and external validity

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The authors report 409 of 2,660 setups (15.4%) with at least one selected security-relevant declaration: 260 unpinned MCP package declarations, 67 broad execution grants and 101 broad skill tool preapprovals. Categories overlap and must not be added together.

  Section 4.1 Table 1, security exposure rows and union

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The authors did not test runtime exploitation, effective deployed permissions or detection recall; the six exploratory credential-to-network alerts did not establish actual exfiltration. A declaration exposure is not a confirmed breach.

  Sections 4.6 Contextual Observations and Graph Alerts, 6 Threats to Validity and Ethical Considerations

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: Including required-field and skill-format categories, 475 of 2,660 setups (17.9%) and 35 of 511 skill collections (6.8%) had at least one selected finding. Those totals are not all security vulnerabilities.

  Section 4.1 Table 1 and Section 4.3 Configuration and Specification Issues

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The paper reports 678 of 2,660 setups flagged across 31 raw candidate rules (25.5%); choosing six reported categories reduces that union to 503 (18.9%), excluding misinterpreted wildcard find grants to 488 (18.3%), then contextual inclusion to 475 (17.9%). The 409 security-exposure setups are a separate selected union, not the final count in this all-category funnel.

  Section 4.4 Separating Rule Selection from Review, Table 2 and adjacent explanation

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: Of 1,063 sampled setups containing MCP configurations, 260 (24.5%) had an unpinned package declaration, whereas 9.8% is the rate across all 2,660 setups. Pinning is a configuration control, not proof a particular malicious version executed.

  Section 4.2 Unpinned MCP packages; Section 3.1 conditional denominators

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The authors state that Claude Code skill allowed-tools entries preapprove calls during the invoking turn and are cleared at the next user message, while ask and deny rules still apply. The paper counts 101 setups and 19 skill collections with broad skill preapproval, not full unconstrained execution by all of those projects.

  Section 4.2 Dependency and Permission Declarations, Skill tool preapproval paragraph

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The corrected study reports 752 human verdicts by one author; 743 matched repository-rule pairs yielded 93.3% agreement with historical pipeline labels (kappa 0.76), falling to 70.7% (kappa 0.23) in 157 model-adjudicated pairs. Agreement is a check on recorded classification, not a validated detector recall or a second independent annotator.

  Section 3.4 Mechanical, Model-Assisted, and Human Review, paragraph beginning Author-conducted manual review

• supportsRepository study finds unpinned MCP dependencies and broad agent execution preapprovals: The v3 reanalysis removed 62 wildcard find permission findings after platform documentation showed that Claude Code did not preapprove its -exec or -delete behavior in that pattern. Scanner and mechanical audit had shared the same mistaken rule interpretation.

  Sections 3.5 Semantic Correction and Reanalysis and 4.1, paragraph on wildcard find semantics