AI & DevOps · Agent security
MCP and AI agent security, in reading order
The articles on this site about keeping coding agents and MCP servers from being turned against you, arranged as one path: the threat model first, then the incidents, then the controls and sandboxes that held.
By Matthews WongReviewed on
Key takeaway
This path starts with why filtering does not stop prompt injection, reads the MCP and coding-agent incidents of 2026 against that threat model, then covers three layers of defence the articles describe: scoped credentials and default-deny writes for MCP access, sandboxes that confine an agent's filesystem and network, and vetting the skills and plugins an agent loads.
Reading path · 25 articles
Read in this order
Each stage builds on the one before. If you already know a stage, skip ahead; the line under each title says what that article adds.
Stages 1 / 4
Start with the threat model
How instructions reach an agent through the content it reads, and why the answer is containment rather than a better filter.
- 01Security9 min readPrompt Injection Attacks on AI Coding AgentsWhy this step: The base case: commands hidden in code, issues and web pages, why filtering fails and how containment reduces the risk.
- 02Security9 min readSandboxing AI Agents and the Lethal TrifectaWhy this step: Names the lethal trifecta and shows how confining filesystem and network keeps even a compromised agent contained.
- 03AI10 min readPrompt Injection Defense: How I Harden AI Systems Against ManipulationWhy this step: Real attack patterns mapped to the OWASP LLM Top 10, with the controls applied when building AI-powered APIs and agents.
- 04Security12 min readRed Teaming AI Agents With Promptfoo: A Practical GuideWhy this step: Turns the threat model into tests: indirect injection through tool output, excessive agency and data leaks, gated in CI.
- 05Security12 min readGitHub Agentic Workflows Study: The Prompt Injection GapWhy this step: A study of real GitHub Agentic Workflow files, and how few of them address prompt injection at all.
Stages 2 / 4
The 2026 incidents and advisories
The threat model, played out: each write-up says what happened, what the research proves, and which controls held.
- 06Security12 min readSentry MCP Prompt Injection: Agentjacking Defence GuideWhy this step: A fake Sentry error became a command channel into Claude Code, Cursor and Codex; what the research proves and omits.
- 07Security12 min readDeadbugz MCP Server: Runtime Tool Metadata Poisoning DefenceWhy this step: A server that rewrote its tool metadata mid-session, and why fingerprinting tool definitions beats a one-time review.
- 08Security11 min readClaude Code and Gemini CLI GitHub Actions Secrets VulnerabilityWhy this step: One GitHub issue reached CI secrets in three agent workflows; the patched versions and a hardening checklist.
- 09Security12 min readGitLost: GitHub Agentic Workflows Prompt Injection DefenceWhy this step: A public issue used to leak private repositories through an agentic workflow, and the limits that stop it.
- 10Security11 min readCursor CVE-2026-22708 RCE: Shell Built-ins Beat the AllowlistWhy this step: Shell built-ins skipped Cursor's command allowlist and ran code; the fix, the sandbox settings and an audit.
- 11Security11 min readSplunk MCP Server CVE-2026-76404: Patch Triage for MCP AppsWhy this step: Reading a high-scoring MCP advisory in context, with a patch-triage routine for MCP apps.
- 12Security12 min readAnthropic Threat Report September 2026: DevOps LessonsWhy this step: What Anthropic's September threat report shows about stolen AI keys and tokens, and what DevOps teams should change.
Stages 3 / 4
Controls around MCP access and agent credentials
What an agent may reach and who answers for its actions: tokens, identities, write controls and the gateway in front of MCP.
- 13Security9 min readMCP Server Security Checklist for DevelopersWhy this step: The baseline for any MCP server: token audience, SSRF, sessions, transports and tool poisoning.
- 14Security11 min readAI Agent Least Privilege: Credentials, Tokens and SecretsWhy this step: Keeps secrets out of the model's context with per-request tokens, scoped tool identities and approval gates.
- 15Security11 min readAI Agent Identity: Delegated Authorization Beyond OAuth 2.1Why this step: Answers who authorised an agent's action: the OAuth act claim, token exchange and the drafts that extend them.
- 16Security12 min readMCP Write Controls: Cloudflare WriteGuard vs Approval PromptsWhy this step: Why an approval prompt is not authorization, and a default-deny design for MCP writes.
- 17Security12 min readShadow MCP Detection with Cloudflare Gateway PolicyWhy this step: Finds MCP traffic nobody approved at the network layer, and where each detection method fails.
- 18Security12 min readEnterprise MCP Reference Architecture with Cloudflare PortalsWhy this step: Puts the controls together into one reference architecture: OAuth, portals, DLP and default-deny writes.
Stages 4 / 4
Sandboxes and the supply chain of agent tools
When the controls fail, the sandbox decides the damage; and the skills and plugins an agent loads are code you did not write.
- 19Security12 min readClaude Code Security Model: Layers, Trust and LimitsWhy this step: What actually gates a Claude Code session: read-only defaults, the directory boundary and the accept-edits list.
- 20Security12 min readAI Coding Agent Sandbox: Fixing Approval Fatigue in CIWhy this step: Approval prompts wear people down; how an OS sandbox removes most of them, and where it breaks in CI.
- 21AI12 min readDocker Sandboxes sbx: Run Claude Code in Cloud MicroVMsWhy this step: Runs coding agents unattended inside Docker microVM sandboxes, locally or moved to Docker's cloud.
- 22Cloud13 min readAWS Lambda MicroVMs for AI Agent Sandboxes: Hooks and LimitsWhy this step: One Firecracker VM per agent session on Lambda, with its hooks, quotas and limits.
- 23AI12 min readPerplexity SPACE: Firecracker Agent Sandbox, Warm Pools, E2BWhy this step: An open-source Firecracker sandbox with warm pools and an E2B-compatible API, and its red-team results.
- 24Security11 min readMalicious Agent Skills: ClawHavoc SKILL.md Supply Chain GuideWhy this step: Malicious SKILL.md files spread through a skills registry; a vetting script and settings to defend agents.
- 25Security13 min readClaude Code Plugin Security: Audit Before You InstallWhy this step: A plugin runs with your privileges, so audit its hooks, MCP egress and skill prose, and pin an exact commit.
The AI & DevOps field guide
More from the AI & DevOps guide
The other reading paths in this section.
- LLM Inference ServingvLLM and SGLang, disaggregated serving, llm-d and KServe, autoscaling and cost per token.
- Kubernetes for AIThe 1.36 and 1.37 upgrades, DRA and gang scheduling, Gateway API routing and agents in the cluster.
- AI SRE & Agentic OpsIncident-investigation agents, MCP servers for ops tools, agents in CI, and the IaC beneath.
- Supply Chain & Regulationnpm and PyPI worms, model signing and AIBOM, secrets in agent commits, the CRA and EU AI Act.