Visual TL;DR
Symlinks collapse sandboxesEffect
File system path tricks escape OS-level isolation completely
Agents self-policeDriver
Security still relies on the agent to restrict its own capabilities
From the article 9+ mentionsMost agents gate commands with a pre-approved list and ask for approval only when a command is not on it.
Prompt injection to RCEContext
Hidden prompts in files trigger same commands as direct user input
From the article 2 mentionsWhatever the agent will do for a user prompt it will also do for an injected prompt hidden in a file or issue, so the chain starts with injection and ends with RCE.
Allow lists bypassedDriver
Pre-approved command checks fail because injected prompts mimic approved usage
70+ flaws across 10 agentsOutcome
Palo Alto researchers pwned every tested coding agent identically
From the articleMore than 70 flaws across 10 coding agents fell to the same handful of bugs, according to BlackHat Asia 2026 talk Bad Vibes, and coding agents security still trusts the agent to police itself.
Agents self-policeDriver
Security still relies on the agent to restrict its own capabilities
From the article 9+ mentionsMost agents gate commands with a pre-approved list and ask for approval only when a command is not on it.
No novel exploits neededEffect
Same bugs work across every vendor without custom attack code
From the articleTwo vulnerability researchers from Palo Alto Networks (NASDAQ:PANW), Nila Shkenazi and Philip Zuckerman, walked the full kill chain from chat prompt to host takeover without a novel exploit.
Prompt injection to RCEContext
Hidden prompts in files trigger same commands as direct user input
From the article 2 mentionsWhatever the agent will do for a user prompt it will also do for an injected prompt hidden in a file or issue, so the chain starts with injection and ends with RCE.
Terminal tools execute commandsCore
From the article 2 mentionsThat assumption held in every agent they tested, because terminal tools are designed to run user supplied commands.
Allow lists bypassedDriver
Pre-approved command checks fail because injected prompts mimic approved usage
Symlinks collapse sandboxesEffect
File system path tricks escape OS-level isolation completely
70+ flaws across 10 agentsOutcome
Palo Alto researchers pwned every tested coding agent identically
From the articleMore than 70 flaws across 10 coding agents fell to the same handful of bugs, according to BlackHat Asia 2026 talk Bad Vibes, and coding agents security still trusts the agent to police itself.
Host takeover achievedOutcome
Kill chain completes from chat window to full machine control
From the articleTwo vulnerability researchers from Palo Alto Networks (NASDAQ:PANW), Nila Shkenazi and Philip Zuckerman, walked the full kill chain from chat prompt to host takeover without a novel exploit.
