--- title: "Agentic AI Security Comes Down to Access, Not the Trick" url: https://daily.dev/posts/agentic-ai-security-comes-down-to-access-not-the-trick-q9sdq1e4s source_url: https://blog.gitguardian.com/agentic-ai-security-blast-radius type: article source: "GitGuardian" published: 2026-08-25T15:02:48.601Z updated: 2026-08-25T15:11:25.882Z tags: ["mcp", "prompt-injection", "secrets-management", "gitguardian"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Agentic AI Security Comes Down to Access, Not the Trick **[GitGuardian](https://daily.dev/sources/gitguardian)** · 11 min read · 0 upvotes · 0 comments ## Summary Three 2026 agentic AI security incidents (GitHub Agentic Workflows/GitLost, Claude Code CVE-2026-21852, Amazon Q Developer CVE-2026-12957) show that prompt injection and exploit vectors only start an incident; the actual damage is determined by what credentials, permissions, and access the agent had available. GitGuardian's State of Secrets Sprawl 2026 data shows 28.6 million new hardcoded secrets on public GitHub in 2025 and rising AI-related secret exposure, and argues that reducing agent blast radius requires blocking credentials at the model/tool boundary, discovering and removing exposed secrets, and fast revocation after compromise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was CVE-2026-21852 in Claude Code and what did it expose? CVE-2026-21852 let a malicious repository set the ANTHROPIC_BASE_URL environment variable, causing Claude Code to send API requests, including the victim's Anthropic API key, to an attacker's endpoint before showing a trust prompt. Check Point Research disclosed it alongside two remote code execution flaws in repository config files (.claude/settings.json, .mcp.json); Anthropic patched all three between August and December 2025. _Teams securing AI coding agents can track vulnerability disclosures like this one through daily.dev._ ### How did the GitLost attack bypass GitHub's Agentic Workflows guardrails? Noma Labs researchers found that adding the single word 'Additionally' to a crafted public issue was enough to bypass GitHub's Agentic Workflows safeguards. The agent had read access to other repositories in the organization, including private ones, and the manipulated prompt caused it to fetch a private repository's README and post it publicly as a comment. _Anyone scoping permissions for AI agents can follow prompt injection research like this via daily.dev._ ### How did the Amazon Q Developer VS Code extension vulnerability CVE-2026-12957 expose AWS credentials? The extension automatically loaded MCP server configurations from a .amazonq/mcp.json file in any opened workspace without requiring consent or a workspace trust check, letting a malicious repository launch an attacker-controlled MCP process that inherited live AWS credentials, including AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and session tokens. Amazon fixed the consent flow in language server version 1.65.0. _Developers patching AI-assisted cloud tooling can keep tabs on fixes like this through daily.dev._ ## Similar posts on daily.dev - [AI coding is fueling a secrets-sprawl crisis few CISOs are containing](https://daily.dev/posts/ai-coding-is-fueling-a-secrets-sprawl-crisis-few-cisos-are-containing-a9saj1sus) · CSO Online · 0 upvotes · 0 comments - [AI Coding Agent Horror Stories: Security Risks Explained](https://daily.dev/posts/ai-coding-agent-horror-stories-security-risks-explained-vv12xoikj) · Docker · 0 upvotes · 0 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-ffq6gdzd6) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#secrets-management](https://daily.dev/tags/secrets-management), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/agentic-ai-security-comes-down-to-access-not-the-trick-q9sdq1e4s)