---
title: 'In the News: September 9, 2026'
description: 'A validated audit of 3,171 repositories finds 16.0% of AI coding-agent harness configurations carry a confirmed security defect, mostly unpinned MCP servers.'
canonical_url: 'https://darkfactory.dev/news/2026-09-09-morning'
markdown_url: 'https://darkfactory.dev/news/2026-09-09-morning.md'
collection: news
date_published: '2026-09-09T07:35:00-04:00'
date_modified: '2026-09-09T07:35:00-04:00'
---

# In the News: September 9, 2026


A validated audit of 3,171 repositories found confirmed security defects in 16.0% of agent-harness setups. Unpinned MCP servers were the most common defect.

## 1. A validated audit of 3,171 repositories finds 16.0% of agent-harness configurations carry a confirmed security defect

**[Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations](https://arxiv.org/abs/2609.07360)** · Benjamin Kapner, Carmel Soceanu, Alicia Petrunin, Hofni Gartner, Red Hat and Ben-Gurion University of the Negev · arXiv, September 7, 2026

Researchers scanned 3,171 public GitHub repositories: 2,660 assembled agent "setups" and 511 published skill collections. They looked for defects in the instruction files, skills, hooks, and MCP server declarations that make up an agent's harness.

A second, independently written implementation re-derived every flagged finding. A model adjudicated disagreements between the two implementations, then a separate model session checked the results against live platform documentation. This validation reduced the raw detection rate from 25.5% to a confirmed 18.4%.

Among setups, 16.0% carry a confirmed security defect. An unpinned MCP server appears in 9.8%, allowing the agent to run whatever version a public registry serves when it starts. Another 3.1% grant command execution through entries that appear scoped but are functionally unrestricted, such as `Bash(python:*)`. Skills whose front matter pre-approves shell access appear in 3.8% of setups and 3.7% of published skill collections. As the authors put it, "a conventional dependency is reviewed as code, while a skill is a document that instructs a privileged agent to read credentials, run shell commands, or contact the network."

The credential-to-network exfiltration path that motivated the project turned up no confirmed instance across the corpus. That path requires a component with access to secrets to hand work to one with network access. The authors released the scanning tool, corpus manifest, and every validation verdict.

**Why it matters:** Teams can act on the findings directly. Pin each MCP server declaration to a version or digest. Treat `Bash(interpreter:*)` grants as unrestricted shell access, and inspect a skill's `allowed-tools` field before installation. The open-source scanner runs in seconds and can serve as a CI check.

---

## Also this cycle

- **[Research acceleration: The view inside OpenAI](https://openai.com/index/research-acceleration-view-inside-openai/)** · OpenAI · September 6, 2026. By mid-August, OpenAI reports, its median researcher spent more than $600 a day on agent inference. The research organization used the equivalent of 3.1 agent-workdays for every human workday, up from parity in June. More than half of successful four-to-eight-hour tasks still required at least one human intervention. Following a security incident, Astra-class compute allocation fell sharply, and other model classes absorbed most of the difference.
- **[I vibe-coded a C compiler that can build SQLite](https://blog.fsck.com/2026/08/21/i-vibe-coded-a-c-compiler/)** · Jesse Vincent, Prime Radiant · blog.fsck.com, August 21, 2026. Vincent instructed his agentic harness to build a standards-compliant ARM64 C compiler in Swift, then compile SQLite and pass SQLite's own tests. The harness ran unsupervised with recursive subagents for about 21 hours and finished the job, verified against a public commit. "It did exactly what I asked."