A critical vulnerability was discovered in Serena, a popular AI coding agent, allowing arbitrary code execution. This flaw, identified by GitLab's Threat Research Group, exists in versions 1.6.1 and earlier. Attackers can exploit it by placing a malicious .serena/project.yml file in a repository. When a developer opens such a project, the malicious code executes. The vulnerability stems from Serena's use of an unsandboxed Jinja2 template engine for processing project configurations. This template engine can access Python's object graph, enabling code execution through well-documented techniques. The exploit bypasses Serena's intended trust mechanism designed to prevent untrusted repositories from running code. MCP servers, used by AI coding tools, present a new attack surface as they have broad access to a developer's local environment. Unlike isolated CI/CD environments, compromised MCP servers can expose sensitive data and internal network resources. The vulnerability was privately reported on August 1, 2026, and a fix was released eight days later in version 1.7.0. Users of Serena are strongly advised to update immediately. Developers building similar AI coding tools should treat project configuration files as untrusted input and ensure their trust gates cover all code paths. Security teams should identify and scrutinize MCP servers running within their organizations.