Your Agent's Config Is a Dependency With No Lockfile

Your dependency policy is probably decent. Locked versions, hash verification, an SBOM if you're serious, a review gate for new packages.

Meanwhile your coding agent imports instructions, skills, hooks, tool declarations, and subagents from public marketplaces and repositories. It runs all of it with your privileges, in your working directory, continuously. And none of it is in the lockfile, because the harness, as researchers now call this layer, has no lockfile.

What's Actually in the Harness

Inventory it sometime: the instruction files, the skills directory, the hooks that fire on events, the MCP server declarations, the subagent definitions. Each of these is code-shaped. Each was probably installed by copying a snippet from a README or a marketplace listing, sometimes written by a stranger, sometimes generated by another model.

We spent a decade teaching teams to treat npm installs as untrusted input. Then we built a new dependency layer, made it executable, made it ambient, and gave it a filename that sounds like configuration.

Someone Finally Measured It

In September 2026, researchers published the first systematic scan of the harness: 3,171 public GitHub repositories with assembled agent setups, 2,660 of them combining multiple component types, plus 511 published skill collections.

The results, and the method deserves respect: every finding was independently re-derived from the repository at its pinned commit, disagreements went to an adjudicator, and a second model session re-checked every counted pair.

16% of setups carry a security defect. The breakdown:

• 9.8% install an MCP server with no version pinned. What you reviewed is not necessarily what runs.
• 3.1% pre-approve arbitrary execution behind a scoped-looking grant. A permission like Bash(python:*) reads as contained and means anything Python can do, which is anything.
• A third class ships inside skill collections: skills that pre-approve the shell for whoever installs them, arriving through marketplaces where a scan could theoretically see them.

The scary reading is the exploit chain. The accurate reading is quieter and worse: these are defects in ordinary setups, assembled by ordinary developers, following ordinary READMEs. Nobody got hacked in the study. Everybody got exposed.

Why This Is Not Like Packages

A dependency executes at build or test time, in a context you scaffolded. The harness runs as you, all the time, in the directory where your work and your secrets live. And its permissions read like configuration to a human scanning a PR diff, while functioning like a grant of execution to a machine reading them literally.

The scoped-looking grant is the perfect emblem: a permission string designed to feel surgical, meaning "run anything."

The Hygiene, Until the Ecosystem Grows Up

Pin everything. MCP server versions, skill sources, hook scripts. What changed since install is the first question an incident will ask.

Review config like dependency changes. The .claude directory and its cousins go through PRs, not direct commits. A config diff is a supply-chain diff.

Scan it. The study's instrument, corpus, and verdicts are released. Run it against your own setups before someone else's paper does.

Grant minimally, out loud. Enumerate what is pre-approved in your agent config, in a file a human reads monthly. The pre-approvals you forgot are the ones that get you.

💡 Pro-tip: the one-line audit: list every permission in your agent config that lets something execute without asking. If that list is longer than you remembered, you have found the article's point in your own repository.

What the Scan Misses

Scanning catches rule-decidable defects only. Intent cannot be scanned, and no lockfile standard exists for this layer yet, so this is manual discipline for now: pins, reviews, scans, minimal grants.

The harness is still worth it. So was npm. We just know how the first chapter of this story goes.

What's in your agent config directory that you didn't put there, and when did you last look?

References

1. Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations (September 2026), instrument and data released: arxiv.org/abs/2609.07360