Your AI Coding Agent Is a Supply Chain: Plugins, Hooks and MCP Configs Need Governing Too
An AI coding agent is a supply chain. Every plugin, lifecycle hook and MCP server it loads is third-party software that runs with the developer’s access, and most organisations review none of it. In our analysis of agents causing accidental damage , the agent was the source of the failure. This follow-up covers the reverse: the extensions around the agent being turned against the organisation.
What October’s AI coding agent threats mean in plain English
Adversa AI’s 2 October 2026 roundup lists several disclosures and research findings. AIR Security named one flaw Plugin4Shell: a branch named like a pinned commit SHA silently swaps malicious code into a plugin during automatic updates. Researchers reported trojanised plugin lifecycle hooks succeeding up to 92.5% of the time per harness across ten attacker objectives. A tool called ZCode packaged whole workspaces, Git history included, into encrypted snapshots uploaded to Alibaba Cloud OSS. Separately, Manifold Security disclosed GitSpawn in early September 2026 (1 to 2 September): a git config remote code execution flaw affecting AI coding agents, as covered by The Hacker News.
Each translates into a familiar business risk. A silent update is an unreviewed change to production tooling. A hook is code that can run on every tool call the agent makes. A workspace upload is a data breach with source code and history attached.
Why agent folders are a goldmine
Adversa AI also reports infostealer families that target Claude, Cursor, Cline and Codex access and refresh tokens, MCP configs holding credentials, and prompt histories stored in predictable, sometimes plaintext, locations. As an illustration, Claude Code keeps MCP server config and sign-in state in ~/.claude.json, beside its ~/.claude folder. Other agents keep similar files in the agent’s config directory and the user profile, so a stealer needs no cleverness to find them.
+------------------------- developer workstation -------------------------+
| Agent harness |
| ├── plugins and skills (third-party code, auto-updating?) |
| ├── lifecycle hooks (can run on every tool call) |
| ├── MCP servers (connect to tickets, repos, databases) |
| └── config + history (tokens, connection strings, prompts) |
| │ |
| ▼ |
| Developer's repos, cloud credentials, network |
+-------------------------------------------------------------------------+
Prompt histories deserve the same classification as source code. Developers paste stack traces, connection strings and customer data into them.
Plugins and MCP servers are dependencies
MCP servers and plugins fit the definition of third-party software. In our analysis of third-party risk , the same logic applied to vendors: you inherit the supplier’s weaknesses. Treat extensions as you treat npm packages and browser extensions.
Approved list and ownership
Maintain an allow-list of plugins and MCP servers. Give each entry a named owner, a purpose and a review date. Anything absent from the list is blocked.
Pin versions, verify, disable auto-update
Plugin4Shell worked because agents ran git checkout on a pinned SHA without verifying what landed, and a branch named with that exact SHA took precedence. Disable auto-update and install plugins from an internal mirror. The install script checks out the pinned full SHA and fails closed unless git rev-parse HEAD returns exactly that SHA. Review each upgrade as a change.
Map to ISO 27001:2022
ISO/IEC 27001:2022 Annex A already covers this ground.
| Control | What it requires | Application to agent extensions |
|---|---|---|
| A.5.19 Information security in supplier relationships | Manage the risks of using suppliers’ products and services | Each plugin author and MCP vendor is a supplier with a risk rating |
| A.5.20 Addressing information security within supplier agreements | Agree security requirements with each supplier | Record licence, data handling and update terms before approval |
| A.5.21 Managing information security in the ICT supply chain | Manage risks across the ICT products and services chain | Pin versions, track provenance, review upgrades |
| A.8.19 Installation of software on operational systems | Control software installation | By analogy, apply to developer workstations: only approved extensions install |
Get secrets out of MCP config files
Truffle Security, as reported by The Hacker News on 1 October 2026, found 543,699 credentials in public GitHub repositories that were still valid as of July 2026, with a median 784 days in a public default branch. An MCP config committed with a literal token joins that pool. Reference secrets from a vault or the OS keychain through environment variables. The sample below is illustrative and client-specific: formats and variable syntax vary, and some clients, such as Codex, use TOML.
{
"mcpServers": {
"tickets": {
"command": "npx",
"args": ["-y", "@example/tickets-mcp@1.4.2"],
"env": { "TICKETS_TOKEN": "${TICKETS_TOKEN}" }
}
}
}
The top-level package version is pinned and the token arrives from the environment at launch. Transitive dependencies still resolve at install time, so install high-trust servers from an internal registry with a lockfile. Any variable in the agent’s environment is readable by every tool and hook the agent runs, so issue short-lived, read-only tokens and rotate on any suspicion of exposure.
Containment by design
NVIDIA announced an open agent safety platform built from OpenShell and Sentry on 28 September 2026, according to CNBC, to keep agents inside defined boundaries. The principle applies with or without that product. Run agents in dev containers with Git credential and SSH-agent forwarding disabled, under low-privilege accounts, with egress limited to the model API and approved hosts. Add EDR rules that alert when processes other than the agent read its config directory or files such as ~/.claude.json.
FAQ
Is an AI coding agent plugin a supply chain risk?
Yes. A plugin is third-party code that executes with the developer’s access, and each update is an unreviewed change. In research covered by Adversa AI, trojanised hook updates compromised all seven tested harnesses, and Defender, Semgrep and policy baselines missed nearly half the samples.
How do I secure MCP servers in a company?
Allow-list them, pin versions and verify what installs, assign an owner, and supply credentials through a vault or keychain. Run the agent in a container with restricted egress.
Which ISO 27001:2022 controls apply?
Annex A controls A.5.19, A.5.20 and A.5.21 cover suppliers and the ICT supply chain. A.8.19 covers software installation, applied here by analogy.
Should plugins auto-update?
No. Auto-update lets a supplier change code on your workstations without review. Pin versions and approve each upgrade.
A one-page AI tooling standard for a small IT team
==================================================
AI CODING TOOLING STANDARD (v1.0)
==================================================
[ ] 1. Keep an allow-list of plugins, hooks, MCP servers.
[ ] 2. Assign a named owner to every entry.
[ ] 3. Pin to a full SHA or exact version; verify what installs.
[ ] 4. Disable auto-update; review upgrades as changes.
[ ] 5. Hold no secrets in config files; use vault or keychain.
[ ] 6. Issue short-lived, least-privilege tokens; rotate.
[ ] 7. Run agents in dev containers, no credential forwarding.
[ ] 8. Limit egress to approved hosts.
[ ] 9. Monitor agent folders with EDR; treat history as sensitive.
[ ] 10. Review the list quarterly; remove unused entries.
==================================================
This week, inventory the plugins and MCP servers on one developer machine and check what sits in the agent folders. Pair that inventory with the change-control practices from our analysis of agents and privileged automation , and the organisation holds a defensible baseline.
Sources: Adversa AI, 2 October 2026 ; The Hacker News ThreatsDay, 1 October 2026 ; CNBC, 28 September 2026 ; The Hacker News on GitSpawn, September 2026 . Facts as publicly reported.