AI Coding Assistants: Trust Is the Attack Surface
Harness, Friday, October 16th, 2026
Harness explains how AI coding agents can be exploited through trusted files, hooks and MCP tools, and how to defend them.
Unlike autocomplete, today's AI coding agents can run commands and act on their own, which Harness says makes trust the new attack surface.
Attackers can plant hidden instructions in trusted files, hooks and MCP tools rather than in the chat box, and the post explores how these vectors enable persistent threats.
It offers guidance on securing agent workflows against such hidden instructions.