Skip to content

Week 8 readings: Security

The required reading is the notes and the second session; the topic is the Week 8 row of the syllabus calendar. Try the first prediction in the notes before you open a source. Everything below is optional.

Read each source to compare a boundary with the one in the course fixture. Do not run any source's payload; every exercise this week uses only the course's inert fixture.

Injection and permission boundaries

  • Source 1 — Invariant, “GitHub MCP Exploited: Accessing private repositories via MCP”. Scope: trace how injected text in a public issue crosses from reading into writing when one agent connection can reach both public and private repositories. Note where the disclosers locate the problem. (incidents/github-mcp; as_of: 2026-09-05; Source 1)
  • Source 2 — Embrace The Red, “GitHub Copilot: Remote Code Execution via Prompt Injection” (about 12 minutes). Read “Exploit Chain Explained” and “Recommendations and Fix” in the post to see how untrusted content changes an approval setting. Compare it with the fixture: which file would the agent have to be unable to write? (incidents/github-copilot-rce; as_of: 2026-10-07; Source 1)
  • Source 3 — Codex documentation, “Agent approvals & security”. Scope: the difference between a sandbox, which constrains writable scope and networking, and an approval policy, which controls when approval is requested. Find the same two controls in the agent you use. (tools/codex; as_of: 2026-09-05; Source 1)
  • Source 4 — Unit 42, “AI Agents Are Here. So Are the Threats.” (about 15 minutes). Read “Simulated Attacks on AI Agents” and “Protection and Mitigation” in the article. The researchers built one assistant in two frameworks and report that most weaknesses came from design, configuration, tool integration and prompt injection, not from either framework. Map each attack onto one boundary of the environment your own agent runs in, and name the local negative test that would show that boundary refusing. Skip the product passages. (studies/unit42-agentic-ai-threats; as_of: 2026-10-09; Source 1)

Supply chain

  • Source 5 — Nx, the S1ngularity postmortem. Scope: how an injection in a workflow led to a publishing token, and why a package name is not installation authority. (incidents/nx-s1ngularity; as_of: 2026-09-05; Source 1)
  • Source 6 — AWS security bulletin on the Amazon Q Developer extension. Scope: separate what was distributed from what executed, and note which of the two the vendor's statement covers. (incidents/amazon-q; as_of: 2026-09-05; Source 1)

Scanning and triage

  • Source 7 — OWASP Top 10 (about 8 minutes). Read “About OWASP Top 10” on the project page to name a risk category before choosing a concrete regression test. A category label is orientation, not a check. (policies/owasp-top-ten; as_of: 2026-10-07; Source 1)
  • Source 8 — OWASP DevSecOps Guideline, the SAST, DAST and IAST comparison (about 8 minutes). Read the table under “How IAST differs from SAST and DAST” in the guideline, then say which of those views your scan and your local regression each give you. (studies/sast-dast-primer; as_of: 2026-10-07; Source 1)
  • Source 9 — Semgrep, a study of two coding agents finding vulnerabilities (about 15 minutes). Read “Key take-aways” and “Same Code, Same AI, Different Bugs Every Time” to separate a security lead from a verified finding, and to see why one agent draft is one sample. (studies/semgrep-ai-vulnerability-finding; as_of: 2026-10-07; Source 1)
  • Source 10 — Sean Heelan, “How I used o3 to find CVE-2025-37899” (about 10 minutes). Read the system-prompt discussion in the post and note what the author says he has not evaluated. (studies/o3-cve-2025-37899; as_of: 2026-10-07; Source 1)

For each source you read, write one sentence that connects its claim to a row in your triage record and one sentence naming what the source does not establish. Factsheet cards are the citations for this page; they are not themselves reading material.