Act on this, mostly signal

Most coding-agent incidents start from packages or MCP servers

What to do

Audit installed packages and MCP servers before blaming the agent itself.

Why

A tracker lists 20 confirmed incidents since July 2025. The author works on node9, a disclosed interest.

What the research found

A community tracker lists 20 confirmed coding-agent security incidents since July 2025, most starting from installed packages or MCP servers rather than the agent itself; the author works on node9, a disclosed interest.

Claims and how well the evidence supports them

The tracker lists 20 confirmed coding-agent security incidents since July 2025 99%
13 of the 20 incidents started with something installed next to the agent such as a package, MCP server, skill or extension 99%
MCP servers are not sandboxed in Claude Code 98%
In claude -p and SDK runs, project MCP servers from .mcp.json load without asking 98%

Evidence

reddit.com https://reddit.com/r/ClaudeAI/comments/1xaqse6/the_agent_was_almost_never_the_way_in_i_went
node9.ai https://node9.ai/incidents

Actionability rated high.