They can be influenced by repository content, fetched instructions, or prompt injection, then use their delegated access to read local files and open outbound connections. When the environment allows arbitrary egress, the agent can turn secrets discovery into immediate exfiltration. The risk is highest when the agent also has access to workspace credentials or automation tokens.
Why shell and network access change the exfiltration equation
AI coding agents become materially more dangerous when they can both execute local commands and reach the network. That combination turns a prompt-influenced assistant into an active operator that can inspect files, enumerate credentials, and send data out without a human in the loop. The core issue is not just execution, but the speed with which discovery can become outbound transfer.
Once an agent has shell access, it can read environment files, config directories, build outputs, and other local surfaces where secrets often accumulate. Once it has network access, the same workflow can immediately post those secrets to an external endpoint, pastebin, webhook, or attacker-controlled server. If egress is unrestricted, the usual containment assumptions around “prompt only” tooling break down.
Repo content and fetched instructions matter because they can steer the agent toward unsafe actions. A poisoned readme, malicious instruction file, or prompt-injection payload can change what the agent searches for, which commands it runs, and where it sends results. That is why the threat is not limited to code generation mistakes; it is a delegated-access problem.
Where the delegated access becomes exploitable
The risk rises sharply when the agent inherits workspace credentials, cloud tokens, package-publishing secrets, or other automation material. Those values are often sufficient to reach source control, cloud APIs, CI systems, ticketing systems, or internal services. In practice, a single compromised agent session can expose far more than the current repository if the runtime inherits broad ambient trust.
This is also why shell and network access should be treated as a compound control decision. Shell alone may expose data locally, and network alone may not reveal much. Together they create a complete exfiltration path: find secret, read secret, transmit secret. The more permissive the environment, the less time defenders have to notice that the agent has crossed from assistance into data movement.
A useful comparison is with AI agent authorization and least privilege. NHIMG’s AI Agent Authorisation Guide frames the control problem as task-scoped and just-in-time access, which is exactly the kind of boundary that reduces exfiltration blast radius. The more an agent can do by default, the more damage a single poisoned instruction can produce.
What practitioners should limit, log, and test
Agents with terminal access should not be assumed safe merely because they are “only” operating inside a developer workstation or CI job. A practical review should start by asking whether the agent can read secrets, whether those secrets can be reused outside the workspace, and whether outbound traffic is constrained to known destinations. If any of those answers is yes, the exfiltration path is already live.
Strong controls include strict egress filtering, short-lived credentials, separate agent workspaces, and explicit approval for high-risk actions such as file reads outside the project tree or any external POST. NHIMG’s AI Agent Observability, Audit and Incident Response Guide is useful here because detection is only effective if you can attribute agent actions and see unusual transfer behaviour early enough to intervene.
When the agent is allowed to act on repository content, threat modelling should include indirect instruction sources, malicious dependencies, and hidden prompt material. NHIMG’s Threat Modelling AI Agents helps practitioners separate normal coding automation from the cases where untrusted content can steer execution toward secret discovery and exfiltration.
Risk and Threat Considerations
AI coding agents with shell and network access create a direct route from prompt manipulation to data theft. The danger is not abstract: if the agent can read secrets and open outbound connections, a malicious instruction can turn one successful inference or file read into immediate leakage.
Failure mechanism: Untrusted repository content, fetched instructions, or prompt injection influences the agent to search for credentials, then the agent uses its delegated shell and network privileges to export the data before any human review.
Impact: Secrets, tokens, and internal files can leave the environment in a single session, increasing the chance of account takeover, cloud abuse, source-code exposure, and follow-on compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI coding agents with shell/network access depend on delegated authority and privilege boundaries. |
| ASI02 — Tool Misuse | The risk centers on an agent using shell and network tools to move data out. | |
| Recommendation — Constrain agent privileges and require approval for high-risk actions. Restrict tool use and monitor for unsafe command and transfer patterns. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The question is about secrets being read locally and exfiltrated over the network. |
| NHI-05 — Overprivileged NHI | Higher exfiltration risk comes from excessive shell, file, and egress permissions. | |
| Recommendation — Reduce secret exposure in agent runtimes and rotate any exposed secrets quickly. Apply least privilege to agent credentials, file access, and network reach. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege directly limits what an AI agent can read and transmit. |
| SC-7 — Boundary Protection | Network egress controls are central to preventing immediate secret exfiltration. | |
| AU-2 — Event Logging | Agent action visibility is needed to detect suspicious reads and transfers. | |
| Recommendation — Limit agent permissions to the minimum needed for the task. Filter and monitor outbound connections from agent runtimes. Log agent commands, file access, and outbound requests. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The issue is overbroad access that lets an agent read and export secrets. |
| CIS-8 — Audit Log Management | Detecting exfiltration depends on usable telemetry for agent actions and transfers. | |
| Recommendation — Review and remove unnecessary agent access paths and credentials. Centralize logs for agent commands, file reads, and network egress. | ||
Practitioner Guidance
What to prioritise: Treat outbound egress and credential scope as the first two control points. If the agent can both read sensitive workspace material and reach the internet, assume exfiltration is a realistic outcome, not a theoretical one.
What to verify: Confirm which secrets are present in the runtime, which destinations are reachable, and whether the agent can invoke tools that bypass user approval. The key question is whether a poisoned instruction can translate directly into a transferable artifact.
What good looks like: The agent can complete routine work without having reusable secrets, unrestricted shell authority, or free-form network reach. The safest setups make secret access, command execution, and outbound transfer separately observable and separately gated.
Practitioner takeaway: The security boundary is not the model prompt alone, it is whether the agent can turn influence into action and action into exfiltration before defenders can intervene.