Meta News

AI coding agents are quickly moving from autocomplete tools to autonomous software engineers capable of reading repositories, executing commands, installing dependencies, modifying files and interacting with cloud services. That increase in capability is also creating a new security problem: developers are giving probabilistic AI systems many of the same privileges they traditionally reserved for themselves.

The central issue is not necessarily that tools such as Claude Code, Codex or Cursor generate insecure code. It is that an agent operating inside a development environment may have access to source code, SSH keys, Git credentials, cloud tokens, environment variables and local files, while simultaneously consuming information from sources that an attacker may be able to manipulate. The result is an attack surface that traditional application-security controls were not designed around.

One of the clearest examples is a technique researchers have called agentjacking. Tenet Security demonstrated an attack involving Sentry, the widely used application-monitoring platform. Sentry applications contain a Data Source Name (DSN) that allows software to submit error reports. These identifiers are intentionally exposed in many applications because historically that was considered relatively safe: they allow someone to submit telemetry, but not read sensitive Sentry data.

That security assumption changes when an AI agent begins reading the reports.

An attacker who discovers a public Sentry DSN can submit a carefully crafted fake error containing instructions disguised as troubleshooting information. Later, a developer might ask an AI coding agent to investigate unresolved Sentry problems. The agent retrieves the malicious report through an MCP integration, interprets the injected content as instructions and may execute commands suggested by the attacker.

The attacker never needs access to the developer’s computer. Instead, the attacker manipulates information that the agent itself retrieves and trusts.

Tenet demonstrated how this can become remote code execution on a developer workstation. A malicious Sentry event contained a fabricated resolution section instructing the coding agent to execute annpxcommand. When agents processed the issue, they could follow those instructions and execute the package using the developer’s own privileges.

Once running locally, code could potentially access environment variables, cloud configuration, Git credentials and other information available to the development environment. Tenet reported that Claude Code, Cursor and Codex all executed injected instructions during its testing, with more than 100 confirmed executions across controlled validation efforts. The researchers reported an 85% success rate, although those figures come from Tenet’s own testing and should be understood in that context.

This is fundamentally different from conventional malware delivery. There is no malicious attachment for the developer to open and no traditional vulnerability that needs to be exploited. The AI agent itself becomes the bridge between attacker-controlled data and local execution.

The attack also exposes a difficult problem for endpoint security. From the operating system’s perspective, many of the actions performed by the agent are legitimate.

The developer authorized the coding agent to execute commands. The agent legitimately queried Sentry. Node.js legitimately executednpx. The resulting process may legitimately read files accessible to the developer.

There may therefore be no obvious exploit for an EDR product, firewall or WAF to detect. Tenet describes this as an Authorized Intent Chain: each individual action is permitted, but the sequence was ultimately initiated by malicious information supplied to the agent.

This shifts the security question away from simply determining whether a command is allowed. Defenders increasingly need to understand why the agent decided to execute it and where the instruction originated.

Model Context Protocol makes the issue especially relevant. MCP allows agents to interact with external tools and data sources such as monitoring systems, databases, repositories and cloud services. Those integrations make agents much more useful because they provide the context necessary to solve real engineering problems.

They also create new trust relationships.

A monitoring alert, GitHub issue, documentation page or database record was historically information intended for a human to interpret. When an autonomous agent consumes the same information, that content can potentially influence what the machine executes.

Agentjacking therefore extends beyond Sentry. Any integration that feeds externally influenced content into an agent capable of taking actions creates a potential prompt-injection boundary.

The problem becomes increasingly important as organizations connect agents to more infrastructure. Every additional tool provides useful context, but potentially also another route through which an attacker can influence the agent.

The obvious solution might appear to be asking developers to approve dangerous commands. In practice, that creates another problem: approval fatigue.

Coding agents can perform hundreds of actions during normal development. If users must approve every command, they quickly become accustomed to clicking “allow” without carefully examining each operation.

Anthropic has reached a similar conclusion with Claude Code. The company is moving toward an automated classifier that determines when human intervention is necessary rather than relying entirely on repeated permission prompts. Anthropic says its research found that humans detect substantially fewer dangerous commands than its classifier under these conditions.

Human oversight remains important, but an approval dialog is not a security architecture by itself.

A stronger model treats the coding agent as an untrusted or partially trusted workload rather than simply an extension of the developer.

The agent should receive only the permissions required for its current task. Credentials should be short-lived where possible, sensitive directories should remain inaccessible, network access should be constrained and potentially dangerous commands should execute inside isolated environments.

Most importantly, security controls need to exist between the agent’s reasoning and the action it performs.

That runtime layer can evaluate whether a command was influenced by external content, whether it attempts to access sensitive resources or whether the requested operation falls outside the scope of the task. Tenet argues that this runtime boundary is the most practical place to mitigate agentjacking because neither traditional endpoint controls nor prompt-level instructions reliably understand the entire chain.

Software development environments have always been valuable targets. Developers frequently possess credentials and access that can eventually lead attackers into production systems. AI agents amplify that risk because they can act on those privileges autonomously.

The important security transition is therefore not simply from “human writes code” to “AI writes code.” It is from software that suggests actions to software that performs them.

That difference changes the security boundary.

An AI coding agent capable of executing commands should increasingly be treated like another privileged identity inside the organization: constrained by least privilege, monitored continuously and prevented from reaching resources it does not require.

The lesson from emerging attacks such as agentjacking is that prompt injection is no longer merely about convincing a chatbot to produce an inappropriate response. Once the model controls development tools, a malicious prompt can become an operating-system command.

And at that point,AI agent security becomes endpoint, identity and software supply-chain security at the same time.

⁠The New Stack