Coding agent

How a coding agent works

A coding agent is an AI agent with a file editor, a shell and git as its tools. Control software sends the task and the code to a language model. The model selects a step, the control software does it and sends back the result.

A typical task has these steps:

1. Read the issue and the files that it touches.
2. Edit one or more files.
3. Run the tests and read the output.
4. Repair what fails and run the tests again.
5. Commit the change and open a pull request.

Why coding agents are a security risk

A coding agent runs commands as its usual work. Thus text that changes its plan can become code execution on the host. The agent has the access of its user: source code, cloud keys, SSH keys and the network.

Three risks come from this:

• Prompt injection. An issue, a README or a web page can contain instructions. OpenAI says prompt injection “can cause the agent to fetch and follow untrusted instructions”.
• Unexpected code execution. The AIShellJack study (September 2025) tried 314 attack payloads on Cursor and GitHub Copilot. Malicious commands ran in a maximum of 84% of tries.
• Abuse by local malware. Malware on the machine can start the agent and use its access.

In practice

Where coding agents operate

Product	Where it operates	Default limits (vendor documentation, October 2026)
Claude Code	Terminal, IDE, desktop app, browser, cloud VM	Auto mode: a classifier model examines each step. Manual mode: starts read-only and asks before edits and commands
OpenAI Codex	Local CLI and cloud	Network access off. Sandbox modes read-only, workspace-write, danger-full-access
GitHub Copilot cloud agent	Ephemeral cloud environment	Pushes to one branch. A human examines and merges each draft pull request

Coding agent scores on SWE-bench

The first SWE-bench study (October 2023) used 2,294 GitHub issues from 12 Python projects. The best model, Claude 2, solved 1.96%. The SWE-agent paper (May 2024) is a different result. It gave a model a custom interface to view and edit files. SWE-agent reached a pass@1 rate of 12.5% on SWE-bench.

Four controls that vendors use

1. A sandbox for files and network. Anthropic says a good sandbox must isolate the two. Without network limits, a compromised agent can send out SSH keys.
2. An approval before risky steps. Claude Code does not auto-approve curl or wget by default. In Manual mode, it asks before it runs them. Codex has the approval policies on-request, never and granular.
3. Credentials kept away from the agent. In Claude Code cloud sessions, GitHub credentials do not go into the session VM.
4. A human check before merge. GitHub makes a human examine and merge each draft pull request from Copilot cloud agent. By default, CI workflows do not start until a person approves them.

The Nx advisory says that the stolen data went to a public s1ngularity-repository in the GitHub account of the user.

Trade-offs

Each approval makes the developer slower, and many approvals cause approval fatigue. Anthropic reports that its sandbox cut permission prompts by 84% in its internal use (October 2025). This is a vendor figure for its own staff.

The alternative is a flag that skips all approvals. The Nx malware used these flags. A team that permits such a flag needs a sandbox around the agent, with no secrets and no open network.

Questions and answers

What is the difference between a coding agent and a code assistant?

A code assistant suggests code, and a person accepts it and runs it. A coding agent does the steps itself. It edits files, runs tests, reads the output and tries again. GitHub Copilot cloud agent, for example, makes changes "in the background" and opens a draft pull request.

How do you operate a coding agent safely?

Limit what the agent can use, not only what it is told. Put it in a sandbox that isolates files and network. Keep network access off by default. Get an approval before risky commands. Keep credentials out of its environment. Make a human examine and merge each change.