Research · curated 14 Jul 2026
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Execution-layer security for autonomous coding agents that read repos, call tools, and run shell commands is fragmented across disconnected literatures, and this survey consolidates the real vulnerabilities and enforcement failure rates defenders must weigh when sandboxing agent harnesses.
A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting.