{}Best AI Code Security

Basics · Lesson 1 of 10

Coding agent attack surface: what an agent can touch

ANSWER FIRST

A coding agent works with the developer's permissions. It reads files, runs shell commands, installs packages and calls MCP servers, so each of those actions is part of the attack surface, alongside the code it writes.

Editorial assessment · Compiled from vendor product, docs, pricing and marketplace pages · Rated October 2026

By Best AI Code Security reviewers · 14 April 2026 · 2 min read

What does an agent do besides write code?

An autocomplete assistant suggests lines. A coding agent such as Claude Code, Cursor's agent or GitHub's Copilot coding agent also takes actions: it edits files, runs commands in a terminal, installs dependencies and calls tools through the Model Context Protocol (MCP). Each action runs with the access of the developer or the pipeline that started it.

Where can things go wrong?

  • Files. To build context, the agent reads the repository and sometimes environment files and configuration that hold keys. Anything it reads can end up in a prompt sent to a model.
  • Commands. A shell command can delete files, change configuration or send data out. Claude Code's PreToolUse hook exists so that a command can be checked, and blocked, before it runs.
  • Packages. An agent can add a dependency in seconds. If the package is malicious or mistyped, its install scripts can run code on the machine before anyone reviews it.
  • MCP servers. An MCP server gives the agent new tools and data. Which servers are allowed, and what they can reach, is a policy decision.
  • Instructions it reads. Text in comments, issues or dependency files can try to steer the model. OWASP lists prompt injection first in its Top 10 for LLM applications (LLM01:2025).

Source: Claude Code hooks documentation · Reviewed Sep 2026

Source: OWASP LLM01:2025 Prompt Injection · Reviewed Sep 2026

What does this mean for controls?

Controls fall into two groups. Some act on the agent while it works: an inventory of assistants and MCP servers, instruction files, command and MCP policy, secrets filtering and install-time package checks. Others act on the result: SAST, SCA and secrets scanning at commit and pull request. The first group is what this site weights at 30% as coding agent guardrails; the second is still required for every pull request, whoever wrote it.

Related