AGNTCon + MCPCon Japan 2026

"Every MCP server, skill, and plugin in your coding agent is code or instructions you never really reviewed, running with your access to your database, your repos, and your keys. Three different ways in, and almost nobody is watching any of them."

Most of the agent security conversation is about prompt injection. Meanwhile there are three underserved vectors sitting right inside the tools you use every day:

- **MCP servers** run with the same access you have. One can look clean when you approve it and change its behavior later, or pull in a compromised dependency on the next run.
- **Skills and instruction files** (`SKILL.md`, `AGENTS.md`, `CLAUDE.md`, rules files) are just text. Nothing to install, nothing to flag. They quietly reshape what your agent does, and hidden instructions, zero-width characters, and pipe-to-shell tricks ride in the same way.
- **Plugins** bundle the first two together and ship through marketplaces with uneven vetting, so a single install can bring in both an MCP server and a skill you never opened.

I'll show where each one lives on disk, why the usual tooling misses it.