Investigating security issues with ChatGPT and the GitHub MCP server

This article demonstrates using Sysdig and GitHub MCP servers with an AI coding agent (OpenAI Codex) to investigate a Falco alert where a dns-helper workload repeatedly writes backups and temporary files under /etc/hosts. The experiment locates the responsible main.go code that reads, backups, and atomically replaces /etc/hosts, assesses operational security risks (possible misconfiguration or abuse if containers are compromised), proposes Kubernetes-friendly mitigations (hostAliases, Services, CoreDNS hosts plugin), and shows automated issue creation and assignment while noting AI limitations and inconsistent outputs.