Study finds real defect rate in agent configs is 16%

A scan of 3,171 GitHub repositories confirmed a security defect in 16% of public agent-harness setups, per a paper posted to arXiv. The study covered 2,660 multi-component setups and 511 skill collections for Claude Code, Cursor, Copilot and Codex, tools developers plug straight into agent workflows. Anyone who clones one of those repos and runs it as configured inherits whatever permissions already sit in that file.

A first pass flagged 25.5% of repos, well above the 16.0% that held up after verification.

That gap closed only because researchers re-derived each finding independently, ran it through an LLM adjudicator, and checked it again in a second model session. More than a third of the initial hits didn't survive that process.

Three defect classes survived that filter. 9.8% of setups install an MCP server with no version pinned. A later update to that server can swap in different code without the repo's own config changing. 3.1% pre-approve arbitrary execution behind a grant that looks scoped, like Bash(python:*), which reads as a narrow permission but isn't one. And 3.8% ship a skill that pre-approves shell access for whoever installs it. That permission goes to anyone who pulls the package without knowing they agreed to it.

None of this needs a compromised registry or a supply chain attack. It's misconfiguration already sitting in public repos. That Bash(python:*) grant deserves a second look. It names a binary, but it doesn't limit what that binary can run once approved.