Researchers studying 3,171 public GitHub repositories found that AI coding-agent configuration files create a new dependency layer for open-source developers, with unpinned MCP servers, broad shell approvals, and pre-approved skills producing confirmed supply-chain defects in 16% of sampled setups.
Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations
Researchers studying 3,171 public GitHub repositories found that AI coding-agent configuration files create a new dependency layer for open-source developers, with unpinned MCP servers, broad shell approvals, and pre-approved skills producing confirmed supply-chain defects in 16% of sampled setups.
Source: Arxiv