Your Agent Is a Security Risk (And Doesn't Know It)

article:
  title: "Your Agent Is a Security Risk"
  slug: "agent-security-risk"
  date: 2026-01-31
  severity: educational
  author: "@andrewolke"
  
summary: |
  Autonomous agents have senior developer access with intern-level security awareness.
  Real incident: Claude Code upgraded npm to vulnerable version, server was compromised.
  
key_points:
  - Agents have developer access without security awareness
  - npm 15.9 vulnerability compromised server via autonomous upgrade
  - 900+ agents exposed on Shodan this week
  - Agents optimize for task completion, not security
  
incidents:
  - name: "npm 15.9 Compromise"
    agent: "Claude Code"
    action: "Autonomous npm upgrade"
    result: "Server takeover"
    
  - name: "Shodan Exposure"
    affected: "900+ agents"
    action: "Ports bound to 0.0.0.0"
    result: "Wallet key extracted in 5 min"
  
action_required:
  - command: "npm audit"
    description: "Scan for vulnerable packages"
  - command: "netstat -tuln | grep 0.0.0.0"
    description: "Check for exposed ports"
  - action: "Move secrets from .env to vault"
  - action: "Enable kill switch"