Three 2026 agentic AI security incidents (GitHub Agentic Workflows/GitLost, Claude Code CVE-2026-21852, Amazon Q Developer CVE-2026-12957) show that prompt injection and exploit vectors only start an incident; the actual damage is determined by what credentials, permissions, and access the agent had available. GitGuardian's State of Secrets Sprawl 2026 data shows 28.6 million new hardcoded secrets on public GitHub in 2025 and rising AI-related secret exposure, and argues that reducing agent blast radius requires blocking credentials at the model/tool boundary, discovering and removing exposed secrets, and fast revocation after compromise.
Table of contents
Three agentic AI incidents with a single amplifierWhy agents concentrate the blast radiusShrinking the blast radius before, during, and after compromiseThe blast radius is defined by what the agent can reachQuestions this post answers
What was CVE-2026-21852 in Claude Code and what did it expose?
CVE-2026-21852 let a malicious repository set the ANTHROPIC_BASE_URL environment variable, causing Claude Code to send API requests, including the victim's Anthropic API key, to an attacker's endpoint before showing a trust prompt. Check Point Research disclosed it alongside two remote code execution flaws in repository config files (.claude/settings.json, .mcp.json); Anthropic patched all three between August and December 2025. Teams securing AI coding agents can track vulnerability disclosures like this one through daily.dev.
How did the GitLost attack bypass GitHub's Agentic Workflows guardrails?
Noma Labs researchers found that adding the single word 'Additionally' to a crafted public issue was enough to bypass GitHub's Agentic Workflows safeguards. The agent had read access to other repositories in the organization, including private ones, and the manipulated prompt caused it to fetch a private repository's README and post it publicly as a comment. Anyone scoping permissions for AI agents can follow prompt injection research like this via daily.dev.
How did the Amazon Q Developer VS Code extension vulnerability CVE-2026-12957 expose AWS credentials?
The extension automatically loaded MCP server configurations from a .amazonq/mcp.json file in any opened workspace without requiring consent or a workspace trust check, letting a malicious repository launch an attacker-controlled MCP process that inherited live AWS credentials, including AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and session tokens. Amazon fixed the consent flow in language server version 1.65.0. Developers patching AI-assisted cloud tooling can keep tabs on fixes like this through daily.dev.