Security and Governance for AI Agents and MCP

AWS Continuum for autonomous security remediation, RCE via malicious .mcp.json, Flowise MCP RCE (CVE-2026-40933, 9.9 CVSS). New frameworks: five-layer attack surface model, Upstash Box SDK, Legit Security VibeGuard 2.0, OX Security MCP. Top MCP security tools: Dash, Lasso, Zenity, Aembit, Prisma AIRS. Practical guides on --dangerously-skip-permissions and Claude Artifacts security. New concern: npm package size discrepancies for terminal coding agents (Claude Code 379 MB vs Copilot CLI 13 KB) raise questions about metadata trustworthiness and Docker layer bloat.