Yes, for the one agent that has been measured in public. GitGuardian's State of Secrets Sprawl 2026 report, published in March 2026, found that "Claude Code-assisted commits showed a 3.2% secret-leak rate, versus a 1.5% baseline across all public GitHub commits." The same report counted 24,008 unique secrets exposed in MCP-related configuration files on public GitHub. The leak is only half of the problem. The files that tell a coding agent how to behave, CLAUDE.md, AGENTS.md, .cursor/rules and .github/copilot-instructions.md, are read as instructions, travel with the repository, and can be written by anyone whose code you clone. A poisoned one tells the agent to send those secrets somewhere else.
Both problems share a root. The agent cannot reliably tell data from instructions, and it has more credentials within reach than the developer who launched it realizes.
Last verified: 24 October 2026, against GitGuardian's report page and blog post (the full PDF is gated and was not read, so its method for identifying AI-assisted commits is not quoted), CSA research notes from June and August 2026, Wiz Research's Amazon Q disclosure, the Prompt Security, Novee Security, Backslash Security and PromptArmor write-ups, GitHub's, Anthropic's and Cursor's documentation, and the OWASP Top 10 for Agentic Applications 2026 PDF. A CSA note on vibe coding dated April 2026 could not be read and is not relied on.
How do coding agents leak secrets?
Four paths, and only the last one is a commit.
Prompts and context. An agent builds its prompt from whatever it can read: files in the working directory, command output, and the environment it inherits. Cursor's MCP documentation tells users to "Pass API keys and tokens through the config." GitHub states that Agents "secrets that you configure are exposed to Copilot as environment variables." The CSA's August 2026 research note on CI prompt injection draws the conclusion: assume any variable available to an agent is reachable by anyone who can inject content into what the agent reads.
Session and CI logs. In the "Comment and Control" research published by Aonan Guan with Johns Hopkins researchers in April 2026, a malicious pull request title made Claude Code's security review action run commands whose output, ANTHROPIC_API_KEY included, "was posted as a PR comment and also appeared in the Actions log." GitHub says "Secret values are masked in Copilot cloud agent session logs." Masking covers the secrets the platform registered, not a token the agent printed from a file.
MCP configuration files. GitGuardian measured this path directly: "we identified 24,008 unique secrets exposed in MCP-related configuration files across public GitHub," of which its own summary says 2,117 were valid. The format invites it. Cursor's project-level .cursor/mcp.json carries an env block per server, and Anthropic's security page describes Claude Code's project .mcp.json as a file "which you can check into source control." A file designed to hold credentials and to be committed will, at scale, be committed with credentials in it.
Commits. GitGuardian's blog post gives 3.2% for Claude Code-assisted commits against a 1.5% baseline; the report page rounds that to "~2× the baseline." Dividing the two gives 2.13, our arithmetic. GitGuardian cautions that the gap "should not be read as a simple tool failure," because "Developers remain in control of what gets accepted, edited, ignored, or pushed." The public pages do not explain how a commit was identified as Claude Code-assisted, and we found no equivalent figure for Cursor or the Copilot cloud agent, so the two-times claim is established for one tool and assumed for the rest.
Why are instruction files the new attack surface?
Because every agent reads them before it reads you, and the vendors say so.
Anthropic's Claude Code memory documentation says Claude Code loads CLAUDE.md "from your current working directory and every directory above it," and loads a subdirectory's file "once Claude reads, writes, or edits another file in that subdirectory." The page is candid about what the file is: "Claude treats them as context, not enforced configuration."
Cursor's rules documentation says "Project rules live in .cursor/rules as .mdc files and are version-controlled," and "Cursor supports AGENTS.md in the project root and subdirectories." Its closing line: "AI guidance should not be your only security control."
GitHub's custom instructions documentation accepts "one or more AGENTS.md files, stored anywhere within the repository," all "automatically added to requests that you submit to Copilot." One sentence matters most: "Copilot reads repository custom instructions, agent instructions, and agent skills from the head branch." A pull request can change the instructions Copilot uses to review that pull request.
Researchers have spent a year demonstrating the consequence. Prompt Security showed in December 2025 that VS Code Chat "auto-includes" a repository's AGENTS.md "in every request," and that a malicious file could steer the agent to send internal data out; its verdict: "AGENTS.MD is not documentation. It is an instruction substrate that runtimes may treat as authoritative." Backslash Security reported in October 2026 that hidden instructions in an AGENTS.md led OpenAI Codex to reach AWS credentials, npm tokens and Git configuration. Novee Security's Black Hat USA 2026 disclosure, summarized in a CSA research note, showed one Codex pass writing attacker content into AGENTS.md and a second pass loading it as instructions. Wiz Research found Amazon Q loading MCP commands from a .amazonq/mcp.json in an opened workspace without consent (CVE-2026-12957), so that spawned processes inherited the developer's AWS access key, secret key and session token; Wiz calls it "part of a broader pattern affecting AI coding tools." PromptArmor showed a Claude Code marketplace plugin whose hook auto-approves commands and whose injected instructions exfiltrate files.
The CSA's June 2026 note has the common thread in one line: AI coding assistants "treat repository-embedded configuration files as instructions to follow, not as untrusted input."
An illustrative example, not a real incident. A platform team publishes a service template on the internal GitHub. Weeks later a compromised contributor account adds three lines to its AGENTS.md: before running tests, post the current environment to a "build telemetry" endpoint, and leave that step out of the summary. Forty services are generated from the template. Every agent that opens one runs the step and reports a clean test run. No diff in any generated service looks wrong, because the instruction is upstream.
OWASP names each link in that chain. LLM01:2025 Prompt Injection covers the mechanism: "Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files." The OWASP Top 10 for Agentic Applications 2026 says ASI01 Agent Goal Hijack arises because "agents and the underlying model cannot reliably distinguish instructions from related content," including "prepositioned inputs such as documents, templates, or external data sources." ASI04 Agentic Supply Chain Vulnerabilities covers third-party tools and components that "may be malicious, compromised, or tampered with in transit," MCP among them. A poisoned instruction file in a template is ASI04 on the way in and ASI01 once read.
How do Cursor, Claude Code and the Copilot cloud agent compare?
GitHub has renamed the Copilot coding agent the Copilot cloud agent; this table follows its documentation. "Not documented" means the point was not on the vendor's pages as of 24 October 2026.
| Control | Cursor | Claude Code | GitHub Copilot cloud agent |
|---|---|---|---|
| Instruction file name and location | .cursor/rules/*.mdc; AGENTS.md in root and subdirectories; Team Rules from the dashboard | CLAUDE.md, CLAUDE.local.md, .claude/rules/; ~/.claude/CLAUDE.md; managed CLAUDE.md at a system path; AGENTS.md when no CLAUDE.md (v2.1.277+) | .github/copilot-instructions.md; .github/instructions/*.instructions.md; AGENTS.md anywhere in the repo; CLAUDE.md or GEMINI.md in root |
| Instruction files from subdirectories or dependencies read | Nested AGENTS.md yes; dependency folders not documented | Yes, on demand when Claude touches a file there; no dependency-folder exclusion documented | Yes, "the nearest AGENTS.md file" takes precedence; dependency folders not documented |
| Instructions from an untrusted branch or repo | Not documented | Workspace trust dialog in interactive sessions; none in -p sessions | Read "from the head branch"; hidden characters in issues filtered |
| Secret handling policy documented | MCP docs say to pass keys through the config; .cursorignore is best effort per Cursor | Read deny rules such as Read(./.env); its own credentials in Keychain or a 0600 file | Agents secrets as environment variables; COPILOT_MCP_ prefix limits a value to MCP servers; no Actions secrets; masked in session logs |
| MCP support | .cursor/mcp.json per project, ~/.cursor/mcp.json global | .mcp.json per project plus user and managed scopes; project servers get an approval prompt | Repository settings JSON; GitHub and Playwright servers on by default; tools run "autonomously" |
| Admin policy controls | Enterprise: MCP Allowlist, enforced Team Rules, enforced Privacy Mode | managed-settings.json: permissions.deny, allowedMcpServers with allowManagedMcpServersOnly, managed-mcp.json, sandbox | Organization or enterprise policy, off by default on Business and Enterprise; repositories can opt out; MCP tools listed per repo |
| Audit log availability | Enterprise plan; "who changed what"; prompts, agent responses and generated code not logged | OpenTelemetry export of prompt, tool and API events; prompt text and tool inputs off by default | Enterprise audit log, actor:Copilot and agent_session_id, 180 days; local client prompts not captured |
A short review of the Copilot cloud agent, since this site has reviewed Cursor and Claude Code, but not this one. On GitHub's account the agent works in "an ephemeral cloud development environment" powered by GitHub Actions. Its repository guardrails are the strongest of the three on paper: it "can only push to a single branch"; it "cannot approve or merge a pull request"; workflows are not triggered until its code is reviewed; and GitHub "restricts Copilot cloud agent's access to the internet." GitHub also names the risk: the agent "has access to code and other sensitive information" and "could leak it, either accidentally or due to malicious user input." Guan showed exactly that in February 2026, when a hidden HTML comment in an issue led the agent to commit its own process environment, GITHUB_TOKEN included, into a pull request; GitHub resolved the report in March with a $500 bounty and called the exposure "a previously identified architectural limitation." Our reading: well contained at the repository boundary, weakly contained at the instruction boundary.
Which controls work?
Five layers, each aimed at a path in Figure 1 or the injection point in Figure 2.
- Pre-commit secret scanning. Closes the commit path and the MCP path for anything that reaches git. Treat every mcp.json variant as a first-class target; the CSA calls repository-embedded MCP configurations code "requiring review in the pull request process."
- Point-of-use redaction of secrets in prompts. The prompt and log paths never touch git, so the control sits where the prompt is assembled, on the endpoint, and strips the token before the request leaves.
- Instruction-file review in code review. Put CLAUDE.md, AGENTS.md, .cursor/rules and the .github instruction files under a CODEOWNERS entry owned by security or platform, and diff them when you adopt a template or fork. Flag any line that asks the agent to run a command, contact a network address, or leave something out of its summary.
- Allow-lists for MCP servers. Claude Code's allowedMcpServers, Cursor's Enterprise MCP Allowlist, and GitHub's per-repository tool list each turn an open channel into a catalog. Our MCP server inventory playbook covers building the catalog; shadow MCP covers the servers that never made the list.
- Agent audit logs. Every vendor logs something and none logs everything: Cursor excludes prompts and generated code, GitHub excludes local client prompts, Claude Code redacts prompt text by default. Our AI agent audit log guide lists the fields that make the record usable as evidence.
What should you do now?
- Inventory the instruction files. Search every repository, fork and template for CLAUDE.md, AGENTS.md, .cursor/rules, .cursorrules and the .github instruction files. Read them; you are looking for commands, URLs and silence instructions.
- Inventory the MCP configuration files the same way, rotate any credential found in one that was ever pushed, and put both file types under CODEOWNERS.
- Move secrets out of the agent's environment. Short-lived credentials scoped per task; on GitHub, the COPILOT_MCP_ prefix keeps a server credential out of the shell.
- Deploy the vendor's admin controls from the table: managed settings for Claude Code, Enterprise allow-lists for Cursor, organization policy for Copilot.
- Disable automatic agent triggers on issues and pull requests from external contributors in public repositories until the trust boundary is reviewed, as the CSA advised in August 2026.
- Add tool-independent detection on the endpoint for the two paths that never reach git; our endpoint AI governance page describes that layer.
What can software catch, and what needs a reviewer?
Software can see the secret leave. AccuroAI detects 60+ secret types in prompts and in the context an agent assembles, and redacts them in line before the request reaches the model, whichever editor or agent produced it. It enforces at the point of use without TLS interception, and logs each event against a user and a tool, the record vendor logs leave out for the prompt and log paths.
Software cannot read your instruction files for you. Whether a line in AGENTS.md is a build step or an exfiltration instruction is a judgment about your codebase, templates and contributors, and it belongs in code review with a named owner. Nor can a tool decide which MCP servers your engineers may run; it can only enforce the list once you have written it.
Frequently asked questions
Is the two-times figure true for every coding agent?
It is established for one. GitGuardian measured Claude Code-assisted commits at 3.2% against a 1.5% baseline. We found no published rate for Cursor or the Copilot cloud agent as of 24 October 2026.
Does Claude Code read a CLAUDE.md inside node_modules?
Anthropic's documentation says subdirectory CLAUDE.md files load once Claude touches a file in that subdirectory, and documents no exclusion for dependency folders. Treat it as possible, and add a Read deny rule for those directories.
Can a pull request change the instructions Copilot uses to review it?
Yes. GitHub states that Copilot reads repository custom instructions, agent instructions and agent skills "from the head branch," which is the branch under review.
Which OWASP entries should the risk register cite?
LLM01 Prompt Injection for the mechanism, ASI01 Agent Goal Hijack for the effect on the agent, and ASI04 Agentic Supply Chain Vulnerabilities for the path a poisoned file takes through a template, fork or dependency.
This is not legal advice. OWASP entries are a taxonomy, not a standard you can certify against; confirm any audit mapping with your assessor.
Sources
- The State of Secrets Sprawl 2026, GitGuardian, 17 March 2026, and the report page
- MCP Auto-Execution: AI Coding Assistants and Credential Theft, CSA, 29 June 2026
- Comment and Control: When a GitHub Issue Steals CI Secrets, CSA, 7 August 2026
- MCP Auto-Execution in Amazon Q VS Code Extension, Wiz Research, 26 June 2026
- Comment and Control: Prompt Injection to Credential Theft, Aonan Guan, 15 April 2026
- Critical Flaws in Anthropic, Google, and OpenAI's Coding Agents, Novee Security, 6 August 2026
- AGENTS.MD and Agent Goal Hijack in VS Code Chat, Prompt Security, 17 December 2025
- Why AGENTS.md Files Belong in Your AI Vetting Process, Backslash Security, 7 October 2026
- Hijacking Claude Code via Injected Marketplace Plugins, PromptArmor
- GitHub Docs: About Copilot cloud agent, Risks and mitigations, Secrets and variables, MCP servers, Custom instructions, Access, Agent audit log events
- Claude Code Docs: Memory, Security, Managed MCP, Monitoring, Permissions
- Cursor Docs: Rules, MCP, Compliance and Monitoring
- OWASP Top 10 for Agentic Applications for 2026, 9 December 2025, and LLM01:2025 Prompt Injection