Pattern: the agent config layer is being treated as an unmanaged dependency graph, and three independent sources said so this week

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.07360 frames instruction files, skills, hooks, MCP declarations and subagents as a dependency layer with no lockfile, no install-time check and no vocabulary for what a component may do. Geiger shipped a scanner for exactly that layer on 09-06. Claude Code 2.1.267 patched a marketplace containment bypass and made three managed allowlists fail closed on the same day. For a builder the concrete move is version-pinning MCP servers and auditing any `Bash(tool:*)` grant, since those are the two classes the paper found most often.