The State of AI Agent Security

Key findings

1. Most agents have real power over the machine they run on. 80% can run shell commands, 60% can write files and 46% can delete them. 32% drive a real browser. If an agent is tricked, this is what the attacker gets.
2. 76% build shell commands from changing input. For coding agents that is often the point. It also means the most important question is whether text from a web page, file or message can ever reach that command.
3. Safeguards are rarely visible in the code. In 70% of projects, nothing in the code checks that a request to act is genuine (a signature or replay check) before the agent acts. Many rely on the person watching instead, which works in a terminal and breaks when the agent runs unattended.
4. 46% register agents or plugins at runtime with no visible check of where they came from, and 38% keep memory with no expiry. Both are ways one bad input can outlast the conversation it arrived in.
5. 9 projects switch a safety feature off in code, such as auto-approving every tool call or skipping permission prompts. Often it is an opt-in "yolo" mode, which is fine for a sandbox and dangerous anywhere else.
6. Only 3 of 50 passed every check, and the median score was 40/100. That is not a ranking of quality: these are popular, well-built projects. It shows how far default agent code is from what a security team would sign off on for production.

What agent projects can do

Share of the 50 projects with each capability, from concrete evidence in their source code.

• Execute shell commands80% (40)
• Read files from the filesystem78% (39)
• Call external APIs72% (36)
• Write or modify files60% (30)
• Delete files or directories46% (23)
• Read from a database44% (22)
• Drive a real browser session32% (16)
• Write to or modify a database26% (13)
• Modify source code or repositories18% (9)
• Read customer or user data14% (7)
• Access cloud infrastructure8% (4)
• Send messages (chat/SMS)4% (2)

Most common patterns to review

Projects with at least one finding of each type. These are static-analysis signals, not confirmed vulnerabilities. Click one to see what it means and how to fix it.

• Command injection risk76% (38)
• Rogue agent onboarding risk46% (23)
• Unbounded memory persistence38% (19)
• Plaintext HTTP endpoint38% (19)
• No permission or tool scope declared36% (18)
• Webhook without visible signature verification22% (11)
• Built-in safety controls turned off18% (9)
• Dependency installed from a git branch18% (9)
• Supply chain control missing18% (9)
• Dangerous MCP tool exposed: shell/exec14% (7)

Scores

A note on secrets

The scanner flagged possible hard-coded keys or passwords in 14 projects. We reviewed every one by hand: nearly all were placeholders, local development defaults or analytics keys that are meant to be public. So we are not reporting any of them as leaks. Open-source maintainers are generally careful here; the bigger risk is what agents can do, not what they ship with.

What to do about it

• Give each agent only the tools its job needs. A support agent does not need a shell.
• Keep text from web pages, files, emails and other agents away from commands and tool arguments, or check it first.
• Ask a person before anything that deletes, pays, sends or deploys, and make the agent stop if approval is missing.
• When agents run unattended, check that each request to act is genuine (signed, recent, not replayed), and log every action.
• Run agents that can execute commands in a container with no personal accounts or credentials.

Method

We searched GitHub for public projects tagged “ai-agents”, “ai-agent”, “llm-agent”, “autonomous-agents”, “agentic-ai” with more than 800 stars, kept those written mainly in Python, TypeScript, JavaScript, and left out curated lists, courses, books, prompt and skill collections, forks, archived projects. We took the 50 most-starred (26 Python, 19 TypeScript, 5 JavaScript). For each one we read up to 60 source files and 5 MB per project, picked the same way as the Slack repo scan, without docs, Markdown, tests, examples or CI files: 2,834 files in total. Nothing was cloned, installed or run. Each project was scanned with the Agent Verify scanner 2.0.0 on November 9, 2026.

Findings are static-analysis signals about the code we read, not confirmed vulnerabilities, and a large project is only partly covered by 60 files. Capabilities describe what a project could do, not whether it is safe to use or whether its authors are careful. We publish totals only and do not name projects next to results. Maintainers who want their own project's results can ask, and we will share them privately.

Free to cite with a link to this page. Questions, corrections or a copy of your project's results: hello@aiblockchainventures.com