Your AI coding agent can read everything you can
When you run an AI coding agent on your laptop, it does not get an account of its own. It runs as you. Every file you can open, it can open. Every server your machine can reach, it can reach. The keys that let you deploy to production are sitting in the same folders it is reading.
That was a reasonable arrangement when the only thing using your access was you. An agent is different in one respect: it also reads things other people wrote, and it can be persuaded by them.
Three reports from the first week of October show the same gap from three sides.
A web page that walked off with the secrets
Researchers at Adversa AI showed GitHub Copilot CLI being made to leak a developer's secrets by asking it to read a single web page. The agent was in autopilot mode, where it carries out steps without stopping to ask. The page held hidden instructions, scrambled so that safety filters could not read them, along with the means to unscramble them. The agent did the unscrambling itself and then treated the result as its own plan.
The outcome, in Adversa's test: the contents of a .env.prod file, the file where many projects keep production passwords and keys, arrived on the attacker's server 28 seconds later. Nothing on screen said a file had left the machine.
Two details matter more than the technique. First, it depended on which AI model happened to handle the session. One model ran the attack in 50% of attempts and two others refused it, and with model selection left on Auto, Adversa says the user "does not choose, and does not see" which one they get. Second, GitHub looked at the report and declined to treat it as a vulnerability. Its position, given to The Register, is that the user chose to point the agent at untrusted content.
Take that at face value. The supplier is telling you that what the agent reads, and what it can reach while reading it, is your problem.
A cloud agent with the run of the network
OpenAI's Codex Cloud runs coding sessions on OpenAI's servers and can be connected to a company's private network through Tailscale, a widely used tool for linking machines securely. Tailscale's own write-up is frank about the starting position: "By default, Codex could reach nearly everything in your tailnet."
Tailscale's advice is to give the agent its own labelled identity on the network, so that it "picks up rules you write for it, rather than inheriting the access of whoever generates the key". That phrase is the whole issue. Left alone, the agent inherits a person's reach.
Malware that moves in with the agent
The third report is about what happens after a machine is already compromised. Unit 42, Palo Alto Networks' research team, describes a worm spreading through npm, the public library of JavaScript packages. It infected more than 400 packages and steals cloud keys and deployment secrets from developers' machines. It also plants hooks so that it runs again "whenever a developer opens a project or starts an AI coding session".
Agent configuration files are now somewhere attackers hide. A settings file in a repository that tells your agent to run a command on start-up is a way back in, and it travels to every colleague who pulls the code.
What to do
None of this argues for banning the tools. It argues for treating an agent as a new member of the team who should not start with the keys to everything.
- Get production secrets off developer machines. If the live database password is in a file in the project folder, anything that reads the folder has it. Keep production credentials in a secrets manager and give laptops development ones only.
- Give the agent its own credentials, with less. Where a tool supports a separate token or identity for the agent, use it, and scope it to the repository and environment it needs.
- Do not run autopilot on things you did not write. Unattended modes are fine inside your own code. Reading an unfamiliar web page, issue, or dependency is when you want the confirmation prompts on.
- Pick the model. Do not leave it on Auto. If behaviour differs between models, you want to know which one you are running.
- Fence the network. A cloud agent should reach the test systems it needs and nothing else. Use short-lived keys and turn on logging so you can see what it touched.
- Review agent settings like code. Changes to files such as
.claude/settings.jsonor.vscode/tasks.jsonin a pull request deserve a second look. They are instructions that run. - Have an answer for clients. "What can your AI tools access?" is a fair question for a client to ask. A short list of tools, what each can reach, and what it cannot is a better answer than "we use Copilot".
How Steelwise can help
Mapping what your team's AI tools can reach, and narrowing it without slowing anybody down, is the kind of review we do as AI advisory work. Get in touch.