August 2026: AI Coding Agent RCEs Are Now a Pattern

Three separate CVEs in four weeks have confirmed what researchers have been arguing since early 2026: prompt injection to remote code execution is not a vendor-specific bug. It is an architectural property of any agent that can read untrusted content and write to its own configuration files. The tooling engineering teams standardized on this year is the tooling this wave of disclosures is targeting.

The Kiro Self-Rewrite#

CVE-2026-10591, disclosed July 22, 2026, is the clearest demonstration of the failure mode. Researchers at Intezer and Kodem Security showed that AWS Kiro would read hidden instructions from a webpage, then rewrite ~/.kiro/settings/mcp.json without any user approval for the file write. The user approved one thing: fetching a URL. The agent then modified the file that controls which code Kiro executes, reloaded it automatically, and started running attacker-controlled processes. The proof-of-concept exfiltrated hostname, username, and platform every ten seconds. A warning pop-up appeared in some cases; the configuration reloaded regardless of the user's response.

Fixed in Kiro v0.11.130. AWS confirmed the fix deployed on April 3, 2026. The CVE number and public advisory did not appear until July 22. That gap between fix and disclosure is itself a data point about how this category of vulnerability gets handled.

Cursor's Third Patch in 2026#

Cursor has addressed the same underlying flaw three times this year. CVE-2026-31854 (March) let website instructions bypass the command whitelist. CVE-2026-26268 planted a Git hook that fired when the agent ran a Git command. Then Cato AI Labs disclosed DuneSlide, CVE-2026-50548 and CVE-2026-50549, both scored CVSS 9.8, both zero-click: prompt-injected content escaped the terminal sandbox entirely. Open a malicious repository. No further action required.

AppSentinels documented that by July 2026 the same five-step sequence had appeared in at least eight major agentic coding tools. The five steps are consistent enough to describe as a formula: untrusted content reaches the agent, the agent treats it as an instruction, a config file changes, a safeguard relaxes, commands execute. No step in that chain is a broken feature. Each one is intended behavior.

Agent-to-Agent Privilege Escalation#

The Google adk-python case, reported by Pillar Security in early August 2026, adds a different dimension. The google/adk-python repository, which had accumulated more than 90 million downloads, ran two classes of automated agents: low-privileged ones accessible to external contributors, and high-privileged ones accessible only to maintainers. Pillar demonstrated that malicious instructions embedded in a pull request could cause the low-privileged agent to pass a prompt to the high-privileged one. That escalation path exposed a GITHUB_TOKEN usable to modify PR comments and impersonate contributors, and a GCP service account credential. Google fixed the underlying issue. Google deemed the exploit non-rewardable.

The Pillar research is the first documented real-world agent-to-agent exploitation method, according to The Register's coverage. That framing matters: the attack surface is no longer just "what can a compromised agent do to a machine." It is now "what can a low-privilege agent do to a high-privilege agent that shares the same repository."

Why Traditional AppSec Tooling Misses This#

The structural problem is that no individual step in these attack chains violates a policy. File edits log as normal developer activity. Shell commands run under the developer's own account. Network calls resemble routine workflows. EDR and SAST tools are built to detect violations. These attacks produce none. The risk accumulates through a sequence of permitted actions, and most current tooling records individual events rather than interpreting sequences.

The June 2026 Miasma worm made this concrete. The self-replicating worm planted MCP and IDE configuration files inside a Microsoft Azure repository via a compromised contributor account. Developers who loaded the project in Claude Code, Cursor, or Gemini CLI triggered a credential harvesting payload automatically. GitHub disabled 73 repositories across four Microsoft organizations within 105 seconds of detection, per StepSecurity. The speed of containment required automated detection at the platform level, not human review.

The Review Perimeter Has Moved#

The conventional model of code review treats the PR as the perimeter: review what changed, approve it, merge. These disclosures describe a different perimeter. The relevant boundary is every file, issue, documentation page, and webpage the agent's context window touches. An attacker with no repository access can inject instructions into a public issue comment, a documentation URL, or an npm package's install script. The WorkOS analysis of the keyv worm, published August 6, 2026, showed exactly that: the worm committed .claude/settings.json and .vscode/tasks.json into every branch it reached, so the payload ran the next time a developer loaded the repository in an agent-assisted IDE.

This is where the role of independent code review shifts. Reviewing every file in the repository, including configuration files, dependency manifests, and hooks, covers the artifacts these attack chains rely on. Code review operating at that scope catches the traces these attacks leave behind. It is not a substitute for platform-level controls on what agents can write without approval, but it is a compensating control for the cases where those platform controls were absent, delayed by months, or rated non-rewardable by the vendor.

The question the August 2026 disclosures leave open is not whether the next variant appears. AppSentinels' analysis puts the architectural cause clearly: any agent that can read files, approve its own actions, and persist configuration changes is exposed by design. Patching one instance does not change that combination of permissions. The pattern will reproduce until the permissions model changes at the platform level, across every tool in the category.

Hyrax is live at hyrax.dev.