Researchers demonstrate that AI coding agents can be compromised by manipulating their external workflow or services, enabling attackers to alter generated code without directly hacking the underlying AI model. The article details vendor defense mechanisms, detection tooling, a counter‑argument to the risk, a risk‑calibration note, and guidance for platform teams.