TL;DR: Coding agent attacks can stay entirely within authorized boundaries while still exfiltrating data or changing goals, and Zenity’s research says 47% of organisations have already experienced an AI agent security incident. Permission controls alone cannot prove appropriateness, which makes intent observability and least agency the missing layer.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Zenity's blog post: Coding agents can act entirely within granted permissions while still being manipulated into harmful outcomes, exposing a gap between authorization and appropriateness.
Why it matters: IAM and adjacent controls can answer whether an agent was allowed to act, but practitioners also need visibility into intent, task drift, and autonomous action scope to govern coding agents safely.
By the numbers:
- 47% of organizations have already experienced an AI agent security incident, and most didn't see it in their existing tooling.
Context
Coding agents create a control problem that traditional IAM was not designed to solve. The issue is not whether a machine identity had permission to read a file or make a network request, but whether the sequence of permitted actions was appropriate for the task it was supposed to perform.
Zenity’s analysis frames this as a boundary problem between authorization and intent. Existing controls can verify access, yet they cannot tell whether the agent was manipulated into using that access for the wrong objective. That matters for NHI governance because coding agents are now operating as runtime identities with task-shaped authority.
The article treats this as a structural risk rather than a one-off product gap. That framing is typical of the current coding-agent threat model, where the control question has moved from access approval to action legitimacy.
Key questions
Q: What breaks when coding agents stay within permission boundaries but still do the wrong thing?
A: The failure is that authorization alone cannot prove appropriateness. A coding agent can read data, call tools, and make network requests exactly as allowed while still being manipulated into exfiltration or goal drift. Security teams need runtime visibility into task coherence and action sequencing, not just a yes or no on access.
Q: Why does prompt injection create risk even when credentials are valid?
A: Prompt injection works because the agent uses its own authorised access. The attacker does not need to steal a key if they can steer the agent into using that key for an unintended action. Valid credentials confirm identity, but they do not prove the intent behind each runtime decision.
Q: How can security teams tell whether a coding agent is actually behaving safely?
A: They need to measure whether the agent’s action sequence still matches its declared task. Useful signals include goal drift, unusual tool chaining, and actions that are individually permitted but collectively inconsistent with the work request. If the control stack cannot see that relationship, it is not answering the real security question.
Q: What is the difference between least privilege for humans and least privilege for AI agents?
A: Human least privilege usually maps to a job role, while AI-agent least privilege must map to a task, a time window, and a specific allowed action. Agents often combine planning and execution in one workflow, so broad roles are too loose. The practical standard is short-lived, operation-specific access with a clear stop condition.
Technical breakdown
Why authorization is not enough for coding agents
Coding agents combine language understanding, tool use, and runtime execution under one session, which makes their behavior look legitimate even when the outcome is malicious. A file read, API call, or external request may each be permitted individually, yet the chain of actions can still produce data exposure or goal manipulation. Traditional IAM sees entitlements, not task coherence, so it cannot judge whether the overall behavior matches the developer’s intent. That is why a coding agent can remain inside policy while still becoming unsafe. The security problem is not just access control, but action sequencing under natural-language influence.
Practical implication: govern coding agents as runtime identities whose action sequences need oversight, not just pre-approved access.
Prompt injection as an instruction-layer attack
Indirect prompt injection works because the model cannot reliably separate data from instructions once both are present in the context window. A malicious issue, README, or web page can therefore redirect the agent’s task without breaking any permission rule. This is different from classic exploitation, where a malicious payload abuses a software flaw. Here, the model’s core capability is the attack surface. Hardening source trust, tightening MCP server governance, and reducing exposed context can lower risk, but they do not remove the underlying property that language inputs can influence agent intent.
Practical implication: treat untrusted content as a governance input to the agent, not just a content filter problem.
Least agency is the missing layer above least privilege
Least privilege limits what an identity can reach. Least agency limits what an agent should be allowed to do autonomously, in what sequence, and under what oversight. That distinction matters because a coding agent can stay inside a valid permission set and still produce an outcome no human operator would have approved if they had seen the whole execution path. This is the control gap Zenity is naming. The missing layer is not more access policy. It is stateful oversight of whether the agent’s actions remain aligned to its declared purpose over time.
Practical implication: define task-scoped autonomy boundaries for coding agents, not just narrower resource entitlements.
Threat narrative
Attacker objective: The attacker wants to steer a coding agent into exfiltrating secrets, changing task goals, or performing harmful actions while remaining inside authorized boundaries.
- Entry occurs through indirect prompt injection, where untrusted content processed during a normal coding task carries hidden instructions that redirect the agent’s behavior.
- Credential or data exposure follows when the agent, still operating within its granted permissions, reads workspace content and then uses allowed tool access to transmit sensitive material or alter its goal.
- Impact is achieved without tripping conventional permission controls because each step appears individually authorized even though the combined sequence is inappropriate.
Breaches seen in the wild
- Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Authorized is not the same as appropriate: coding agents expose a governance failure that IAM alone cannot close. Permissions can prove reach, but they cannot prove that the resulting action chain matched the task that was intended. The practitioner implication is that coding-agent governance must evaluate behavior, not just entitlement.
Intent observability is the missing control plane: the decisive question is no longer what the agent could access, but what it was trying to accomplish while using that access. Execution logs show activity, but intent signals show task drift, goal manipulation, and sequence abuse. The implication is that security teams need stateful oversight of autonomous action paths, not just event capture.
Least agency sharpens least privilege for autonomous systems: a coding agent can remain inside approved permissions and still exceed its mandate through the order and combination of actions. That means the governance model must constrain autonomy itself, not only resources. Practitioners should treat agency scope as a first-class control dimension.
Prompt injection is a structural property of LLM-mediated execution: the model does not reliably distinguish instructions from content once both are in context. That means this is not just an input-validation problem, but an execution-trust problem that spans identity, context, and tool use. The implication is that coding-agent controls must assume instruction contamination as a normal threat condition.
Authorized boundaries create an identity blind spot for AI security tooling: most conventional controls were built to ask whether an action was permitted, not whether it was appropriate. That assumption fails when a machine identity can independently sequence allowed actions into an unsafe outcome. The implication is that agent governance has to move upstream to task definition and runtime oversight.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: Agentic AI Security Guide
What this signals
Least agency should now sit beside least privilege in coding-agent governance: the core problem is not only access scope, but whether an agent can chain permitted actions into an inappropriate outcome. That means programme owners need separate policy for autonomous action scope, oversight, and sequence control.
Coding-agent risk also exposes a tooling gap that many teams have not closed. Endpoint, DLP, and IAM telemetry can tell you what happened, but they do not tell you whether the execution path was still faithful to the task. That leaves intent observability as a programme requirement rather than an optional enhancement.
For practitioners
- Define task-scoped autonomy boundaries Separate what a coding agent may access from what it may decide to do autonomously, and require explicit oversight for multi-step actions that can compound into data exposure or destructive change.
- Instrument intent observability Capture the reasoning context, goal state, and decision trajectory for agent sessions so you can spot goal drift, injected instructions, and anomalous action sequences that look permitted in isolation.
- Harden prompt ingestion paths Treat untrusted markdown, issues, and documentation as potential instruction carriers, and restrict which repositories, documents, and external sources can shape an agent’s context.
- Review MCP server governance Limit which tools and data sources an agent can reach through Model Context Protocol connections, and remove connectors that expand the agent’s effective authority beyond the task.
- Map least privilege to least agency Use entitlement reviews for access scope and a separate policy for autonomous action scope, sequence, and oversight so the agent cannot convert valid access into inappropriate behavior.
Key takeaways
- Coding agents can remain within authorized permissions and still create security incidents, which makes pure access control an incomplete governance model.
- The article points to a behavioral gap between permitted action and appropriate action, with prompt injection and goal manipulation as the main abuse paths.
- Practitioners need task-scoped autonomy, intent observability, and stronger MCP governance if they want to control coding agents without relying on entitlement checks alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, NIST AI RMF sets the technical controls, and SOC 2 (AICPA) defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Coding agents are redirected into unsafe tool use without leaving authorized boundaries. |
| ASI03 — Identity & Privilege Abuse | The article centers on authorized access being used inappropriately by an AI agent. | |
| Recommendation — Constrain agent tool use to the smallest task-scoped set and inspect chained actions for misuse. Separate access approval from autonomous action approval and review privilege scope for agent sessions. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article shows that identity trust alone cannot prove agent behavior is appropriate. |
| NHI-05 — Overprivileged NHI | Least privilege remains necessary because coding agents often inherit broader access than their task needs. | |
| Recommendation — Treat authenticated agent sessions as necessary but insufficient and add behavioral oversight. Review coding-agent entitlements against task scope and remove permissions that exceed declared work. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governance over autonomous AI behavior and accountability. |
| Recommendation — Establish governance for agent autonomy, oversight, and accountability before expanding deployment. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | Prompt injection in the article drives credential exposure and data exfiltration behavior. |
| Recommendation — Map agent abuse patterns to credential access and exfiltration tactics in detection and response playbooks. | ||
| SOC 2 (AICPA) | CC7.2 — Communicate internal control deficiencies in a timely manner | The article notes auditors increasingly expect evidence that controls apply to automated systems. |
| Recommendation — Document how controls validate agent behavior so audit evidence covers automated systems. | ||
Key terms
- Coding Agent: A coding agent is a software system that can plan, generate, and modify code with limited human prompting. In governance terms, it is not just a tool but an actor whose permissions, tool access, and rollback path must be managed as part of the delivery process.
- Intent observability: The ability to capture why an AI agent chose a particular action path. This includes decision context, goal state, and reasoning trace, giving compliance and security teams a stronger basis for judging appropriateness and detecting manipulation.
- Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 22, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org