As AI coding agents become embedded in developer workflows, the attack surface has expanded well beyond source code to include configuration files, agent instruction files, runtime settings, and IDE extensions. Four attack surface categories are identified: what executes (project configs that trigger commands), what instructs (agent instruction files like CLAUDE.md or Skill.md that steer agent behavior), what connects (runtime configs that redirect API endpoints or expose external services), and what extends (IDE extensions with broad system access). Real-world examples from VirusTotal include a weaponized tasks.json linked to North Korean threat actors, Skill.md files instructing agents to exfiltrate API keys, settings.json files that silently redirect Claude Code traffic to third-party proxies, and a VS Code extension containing protestware. Traditional signature-based scanners miss these threats because the files are syntactically valid. Google recommends semantic analysis via VirusTotal Code Insight and agentic threat intelligence to detect malicious intent in plain-text artifacts, alongside repository-level security policies and least-privilege access for coding agents.
