Top AI coding agent security resources — November 2026

Summary

The November 2026 roundup covers three coding agent flaws: a trailing dot in a filename let Copilot in Visual Studio and SQL Server Management Studio write to its MCP and settings files and reach command execution, a Claude Code child session skipped hook consent in a malicious repository, and an opencode no-consent RCE was fixed in a release that never mentioned security and has no CVE. Microsoft patched the Copilot issue, while Anthropic closed the Claude Code report as Informative.

Topics

• AI agents
• Coding assistants

Related items

• InfoAnthropic reports $17 billion in Q3 revenue, purchase commitments of $895.4 billion in revised S-1Same vendor · CNBC Technology
• InfoCybersecurity M&A Roundup: 37 Deals Announced in October 2026Same vendor · SecurityWeek
• InfoIntroducing the Grid Protectors ProgramSame vendor · OpenAI Blog
• InfoMicrosoft's AI Risk Report Misses This Key DetailSame vendor · Dark Reading
• InfoThe U.S. Census Bureau and “Super Intelligence”Same vendor · Simon Willison's Weblog