# MCP and AI agent security, in reading order

> MCP and AI agent security in reading order: prompt injection, the 2026 MCP incidents, access controls, agent sandboxes and the supply chain of skills.

URL: https://www.matthewswong.com/en/ai-devops/mcp-agent-security/

- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Reviewed on: 17 October 2026

> **Key takeaway:** This path starts with why filtering does not stop prompt injection, reads the MCP and coding-agent incidents of 2026 against that threat model, then covers three layers of defence the articles describe: scoped credentials and default-deny writes for MCP access, sandboxes that confine an agent's filesystem and network, and vetting the skills and plugins an agent loads.

The articles on this site about keeping coding agents and MCP servers from being turned against you, arranged as one path: the threat model first, then the incidents, then the controls and sandboxes that held.

## Read in this order

Each stage builds on the one before. If you already know a stage, skip ahead; the line under each title says what that article adds.

### Stages 1: Start with the threat model

How instructions reach an agent through the content it reads, and why the answer is containment rather than a better filter.

1. [Prompt Injection Attacks on AI Coding Agents](https://www.matthewswong.com/en/blog/prompt-injection-ai-coding-agents/): The base case: commands hidden in code, issues and web pages, why filtering fails and how containment reduces the risk.
2. [Sandboxing AI Agents and the Lethal Trifecta](https://www.matthewswong.com/en/blog/sandboxing-ai-agents-lethal-trifecta/): Names the lethal trifecta and shows how confining filesystem and network keeps even a compromised agent contained.
3. [Prompt Injection Defense: How I Harden AI Systems Against Manipulation](https://www.matthewswong.com/en/blog/ai-prompt-injection-defense/): Real attack patterns mapped to the OWASP LLM Top 10, with the controls applied when building AI-powered APIs and agents.
4. [Red Teaming AI Agents With Promptfoo: A Practical Guide](https://www.matthewswong.com/en/blog/red-teaming-ai-agents-promptfoo/): Turns the threat model into tests: indirect injection through tool output, excessive agency and data leaks, gated in CI.
5. [GitHub Agentic Workflows Study: The Prompt Injection Gap](https://www.matthewswong.com/en/blog/gh-aw-empirical-study-prompt-injection-gap/): A study of real GitHub Agentic Workflow files, and how few of them address prompt injection at all.

### Stages 2: The 2026 incidents and advisories

The threat model, played out: each write-up says what happened, what the research proves, and which controls held.

6. [Sentry MCP Prompt Injection: Agentjacking Defence Guide](https://www.matthewswong.com/en/blog/sentry-mcp-agentjacking-prompt-injection-incident-agents/): A fake Sentry error became a command channel into Claude Code, Cursor and Codex; what the research proves and omits.
7. [Deadbugz MCP Server: Runtime Tool Metadata Poisoning Defence](https://www.matthewswong.com/en/blog/deadbugz-mcp-runtime-metadata-poisoning/): A server that rewrote its tool metadata mid-session, and why fingerprinting tool definitions beats a one-time review.
8. [Claude Code and Gemini CLI GitHub Actions Secrets Vulnerability](https://www.matthewswong.com/en/blog/claude-code-gemini-cli-codex-ci-secrets-github-issue/): One GitHub issue reached CI secrets in three agent workflows; the patched versions and a hardening checklist.
9. [GitLost: GitHub Agentic Workflows Prompt Injection Defence](https://www.matthewswong.com/en/blog/gitlost-github-agentic-workflows-prompt-injection/): A public issue used to leak private repositories through an agentic workflow, and the limits that stop it.
10. [Cursor CVE-2026-22708 RCE: Shell Built-ins Beat the Allowlist](https://www.matthewswong.com/en/blog/cursor-cve-2026-22708-shell-builtins-allowlist-bypass/): Shell built-ins skipped Cursor's command allowlist and ran code; the fix, the sandbox settings and an audit.
11. [Splunk MCP Server CVE-2026-76404: Patch Triage for MCP Apps](https://www.matthewswong.com/en/blog/splunk-mcp-server-cve-2026-76404-ai-toolkit-advisory/): Reading a high-scoring MCP advisory in context, with a patch-triage routine for MCP apps.
12. [Anthropic Threat Report September 2026: DevOps Lessons](https://www.matthewswong.com/en/blog/anthropic-threat-report-september-2026-agent-attacks/): What Anthropic's September threat report shows about stolen AI keys and tokens, and what DevOps teams should change.

### Stages 3: Controls around MCP access and agent credentials

What an agent may reach and who answers for its actions: tokens, identities, write controls and the gateway in front of MCP.

13. [MCP Server Security Checklist for Developers](https://www.matthewswong.com/en/blog/mcp-server-security-checklist/): The baseline for any MCP server: token audience, SSRF, sessions, transports and tool poisoning.
14. [AI Agent Least Privilege: Credentials, Tokens and Secrets](https://www.matthewswong.com/en/blog/ai-agent-least-privilege-credentials/): Keeps secrets out of the model's context with per-request tokens, scoped tool identities and approval gates.
15. [AI Agent Identity: Delegated Authorization Beyond OAuth 2.1](https://www.matthewswong.com/en/blog/ai-agent-identity-delegated-authorization/): Answers who authorised an agent's action: the OAuth act claim, token exchange and the drafts that extend them.
16. [MCP Write Controls: Cloudflare WriteGuard vs Approval Prompts](https://www.matthewswong.com/en/blog/cloudflare-writeguard-mcp-write-controls/): Why an approval prompt is not authorization, and a default-deny design for MCP writes.
17. [Shadow MCP Detection with Cloudflare Gateway Policy](https://www.matthewswong.com/en/blog/cloudflare-shadow-mcp-detection-gateway-policy/): Finds MCP traffic nobody approved at the network layer, and where each detection method fails.
18. [Enterprise MCP Reference Architecture with Cloudflare Portals](https://www.matthewswong.com/en/blog/cloudflare-enterprise-mcp-reference-architecture-portals/): Puts the controls together into one reference architecture: OAuth, portals, DLP and default-deny writes.

### Stages 4: Sandboxes and the supply chain of agent tools

When the controls fail, the sandbox decides the damage; and the skills and plugins an agent loads are code you did not write.

19. [Claude Code Security Model: Layers, Trust and Limits](https://www.matthewswong.com/en/blog/claude-code-security-model-layers/): What actually gates a Claude Code session: read-only defaults, the directory boundary and the accept-edits list.
20. [AI Coding Agent Sandbox: Fixing Approval Fatigue in CI](https://www.matthewswong.com/en/blog/anthropic-how-we-contain-claude-sandbox-approval-fatigue/): Approval prompts wear people down; how an OS sandbox removes most of them, and where it breaks in CI.
21. [Docker Sandboxes sbx: Run Claude Code in Cloud MicroVMs](https://www.matthewswong.com/en/blog/docker-sandboxes-cloud-sandboxes-sbx-guide/): Runs coding agents unattended inside Docker microVM sandboxes, locally or moved to Docker's cloud.
22. [AWS Lambda MicroVMs for AI Agent Sandboxes: Hooks and Limits](https://www.matthewswong.com/en/blog/aws-lambda-microvms-ai-agent-sandboxes/): One Firecracker VM per agent session on Lambda, with its hooks, quotas and limits.
23. [Perplexity SPACE: Firecracker Agent Sandbox, Warm Pools, E2B](https://www.matthewswong.com/en/blog/perplexity-space-firecracker-agent-sandbox/): An open-source Firecracker sandbox with warm pools and an E2B-compatible API, and its red-team results.
24. [Malicious Agent Skills: ClawHavoc SKILL.md Supply Chain Guide](https://www.matthewswong.com/en/blog/agent-skills-supply-chain-clawhavoc-skill-md/): Malicious SKILL.md files spread through a skills registry; a vetting script and settings to defend agents.
25. [Claude Code Plugin Security: Audit Before You Install](https://www.matthewswong.com/en/blog/claude-code-plugin-supply-chain-security/): A plugin runs with your privileges, so audit its hooks, MCP egress and skill prose, and pin an exact commit.

## More from the AI & DevOps guide

- [LLM Inference Serving](https://www.matthewswong.com/en/ai-devops/llm-inference-serving/): vLLM and SGLang, disaggregated serving, llm-d and KServe, autoscaling and cost per token. (25 articles)
- [Kubernetes for AI](https://www.matthewswong.com/en/ai-devops/kubernetes-for-ai/): The 1.36 and 1.37 upgrades, DRA and gang scheduling, Gateway API routing and agents in the cluster. (24 articles)
- [AI SRE & Agentic Ops](https://www.matthewswong.com/en/ai-devops/ai-sre-and-agentic-ops/): Incident-investigation agents, MCP servers for ops tools, agents in CI, and the IaC beneath. (25 articles)
- [Supply Chain & Regulation](https://www.matthewswong.com/en/ai-devops/software-supply-chain-and-regulation/): npm and PyPI worms, model signing and AIBOM, secrets in agent commits, the CRA and EU AI Act. (23 articles)

---

- HTML version: https://www.matthewswong.com/en/ai-devops/mcp-agent-security/
- Bahasa Indonesia: https://www.matthewswong.com/id/ai-devops/mcp-agent-security/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json