Finding the Agent Infrastructure: What Internet Measurement Can and Cannot Say About AI Coding Tool Exposure

In September 2026, researchers disclosed a class of configuration injection flaws affecting several AI coding agents, including Claude Code, Codex, Goose, Qwen Code and Grok Build, tracked under identifiers including CVE-2026-19592. The mechanism is that a crafted repository can influence how the agent invokes subprocesses, resulting in command execution on the developer's machine.

That vulnerability class is a workstation and supply chain problem. It is not, on its face, an internet exposure problem. The distinction matters, because it determines whether a cyberspace search engine has anything useful to say about it.

What is actually reachable

AI coding agents run locally. They are not services listening on a port. A search engine that indexes internet-reachable hosts will not find a developer's agent process, and it should not be expected to.

What is reachable is the supporting infrastructure that these tools connect to and that organisations deploy around them. Three categories are worth measuring.

Self-hosted model and gateway endpoints. Teams that run their own inference endpoints or API gateways expose a service that accepts requests. Where those services are reachable from the internet, they are a distinct attack surface with its own vulnerability history, including the authentication bypass issues reported in AI gateway software during 2026.

Development and CI infrastructure. Self-hosted source control, build servers and artifact repositories are frequently exposed, sometimes deliberately to allow remote access. These systems hold the credentials that a compromised developer workstation would be used to reach, which makes them relevant to the blast radius of a coding agent compromise even though they are not the agent itself.

Management interfaces for developer tooling. Administrative consoles for internal developer platforms, container registries and orchestration systems are often reachable, and they are the systems where a foothold converts into broad access.

Reading the measurement honestly

A query for any of these categories returns a population of reachable hosts. The interpretation requires care.

Reachability does not identify the agent. An exposed build server tells you that a build server is exposed. It does not tell you whether the developers using it run an affected coding agent, or whether that agent has processed a malicious repository. The measurement describes the environment, not the incident.

Fingerprints are imprecise. Self-hosted developer infrastructure is frequently customised, proxied or placed behind authentication that changes the observable banner. A query undercounts the deployed population, sometimes substantially.

Exposure is a precondition, not a finding. A reachable artifact repository is a risk factor. Whether it is a vulnerability depends on its patch level, its authentication configuration and what credentials it holds.

The most relevant systems may not be reachable at all. The developer workstation where the agent runs is almost never internet-reachable, and it is where the disclosed flaws actually execute. Measurement cannot see it.

Where measurement does help

Given those limits, the useful applications are narrower but still concrete.

Inventory the credential-bearing systems. The reason a coding agent compromise matters is what the agent can reach. Listing the source control, registry, CI and cloud endpoints that developers authenticate to, and checking which of them are internet-reachable, produces a map of the blast radius. That map is useful regardless of whether any agent is compromised.

Check the AI gateway surface specifically. Self-hosted model gateways and API proxies have had their own authentication flaws in 2026. Querying for the products in use establishes whether any are exposed, which is a separate and more directly exploitable question than the coding agent flaws.

Verify that internal-only is actually internal. Many organisations intend for developer infrastructure to be internal but discover exposed management interfaces during an external check. Running the query against your own address space answers the question with evidence rather than assumption.

Track the population over time. If a service was exposed and has been restricted, re-running the query confirms the change. If a new service appears, the change is visible.

The honest conclusion

Internet measurement is the right tool for the supporting infrastructure and the wrong tool for the coding agent flaw itself. The disclosed vulnerabilities execute on developer machines, and no external scan sees those.

What the measurement does is bound the consequences. The configuration injection flaws matter because a developer workstation holds credentials that reach build systems, registries and cloud environments. Knowing which of those systems are exposed, and which are properly internal, is the part of the risk that can be measured from outside.

The rest requires the internal work that measurement cannot replace: patching the agents, reviewing repository configuration as untrusted input, and running automated agent tasks in a scoped environment rather than with the developer's full credential set.

References

• Manifold Security research on configuration injection in AI coding agents, September 2026, covering CVE-2026-19592 and related identifiers.
• Public reporting on 2026 authentication bypass flaws in self-hosted AI gateway software.
• ZoomEye cyberspace search engine documentation for service and product queries.