Key takeaway: Coding agents changed the repository threat model: configuration, hooks, instructions and tool definitions can influence privileged agent behavior.
For years, opening a repository was mostly a reading operation. Coding agents changed that assumption.
Modern agents inspect repository instructions, invoke tools, run shell commands, modify files, use credentials and sometimes communicate externally. The boundary starts before code execution: what can the repository persuade or configure the agent to do?
A current research roundup maps multiple recent cases involving repository-controlled material, plugins, agent configuration and sandboxes: https://adversa.ai/blog/top-ai-coding-agent-security-resources-october-2026/
The shift
Old: UNTRUSTED REPO → HUMAN REVIEW → BUILD
Emerging: UNTRUSTED REPO → AGENT READS → AGENT REASONS → TOOLS EXECUTE
The agent may hold source, Git, registry, cloud, CI and MCP access. Repository intake is now a security event.
"Approval required" is incomplete
Approval helps when the dangerous action is visible and correctly classified. It is weaker when execution happens during initialization, trusted tools interpret hostile arguments, hooks change underneath trusted references, sandboxes expose unexpected host state, or harmless-looking actions have privileged downstream effects.
Ask: What authority exists before, during and after the prompt?
Practical control model
- Treat unknown repositories as hostile.
- Separate agent identity from developer identity.
- Default-deny tools and network destinations.
- Version and review agent instructions, MCP definitions, hooks and permissions.
- Make sensitive egress observable.
- Test policy enforcement adversarially.
OWASP calls the principle least agency: https://owasp.github.io/DevSecOpsGuideline/2-Process/2-2-Develop/2-2-5-AI-Agent-and-MCP-Security/
The useful unit of analysis is:
REPOSITORY → AGENT → IDENTITY → TOOL → RUNTIME → NETWORK → TARGET
If you cannot reconstruct that chain, you cannot confidently answer what a compromised repository can achieve.
About 0day Factory
0day Factory researches how real attack paths emerge across software, infrastructure, identity, security controls and organizational boundaries.