TL;DR: Claude Code runs with file, shell, and network access, which shifts security from prompt handling to governing what data the agent can read, move, and leak, according to Orion. Permission prompts and scope limits help, but they do not determine whether sensitive content should leave context.
At a glance
What this is: Claude Code security is about governing what an agent can read, move and leak, not just approving its terminal actions.
Why it matters: IAM and security teams need to treat agentic coding tools as data movers as well as executors, because permissions alone do not stop secrets from leaving context.
Context
Claude Code security is a data-governance problem as much as an access-control problem. When an agent can read repository files, environment variables, shell output and external tools, the main risk is not whether a command is authorised, but whether sensitive content is allowed to move at all.
This matters to IAM, PAM and NHI programmes because agentic coding tools behave like high-speed non-human identities with broad reach across code, secrets and tooling. The governance gap appears when teams treat permission prompts as sufficient control, even though the same prompt can approve movement of public files and regulated data alike.
Key questions
Q: What breaks when an agentic coding tool has permissions but no data control?
A: The control model breaks at the point of disclosure. An agent can be authorised to read a file or run a command and still move sensitive content, because the approval layer sees the action but not the meaning of the data. That leaves secrets, regulated records and credentials exposed through ordinary workflows unless policy inspects the content itself.
Q: Why do agentic coding tools increase secret exposure risk in repositories?
A: They expand the number of objects treated as operational context. Once an assistant can ingest environment files, configuration files, command output, and tool results, any embedded secret can be surfaced, reasoned over, or forwarded without the developer deliberately copying it. The risk grows with the agent’s reach, not just with user intent.
Q: What are the signs that prompt injection is influencing an AI coding assistant?
A: Look for unexpected tool calls, unexplained file reads, outbound requests that do not match the developer’s task, or the agent acting on instructions that only appear inside code comments, README files or dependency content. Those signals usually mean the assistant is following untrusted input rather than the operator’s intent.
Q: Should organisations use permission prompts or content-aware controls for AI coding agents?
A: They need both, but content-aware controls solve the harder problem. Permission prompts are useful for limiting actions, yet they do not tell you whether the data being moved is sensitive. Organisations should keep approvals as a baseline and add content inspection where agents can read, transform and transmit information.
Technical breakdown
Why agentic coding tools break the permission-only model
An agentic coding tool is not a chat interface. It can inspect files, execute commands, call networked tools and chain those actions without waiting for a human to restate each step. That makes the security question shift from input control to runtime authority. The control boundary is no longer just authentication or approval, but what the agent can access once it is inside a work session. In NHI terms, the agent behaves like a high-privilege service actor whose permissions may be valid while the data it touches is still inappropriate to disclose. This is why ordinary approval flows miss the core risk.
Practical implication: Treat the agent’s runtime access as a governed identity surface, not just a productivity feature.
How secrets enter context and leave through ordinary workflows
Secrets usually leak because they are already sitting in places the agent can read. .env files, config files, credentials files, command output and repository text all become part of the agent’s context, which means the model can process them even when no one intended to share them. Prompt injection then turns untrusted content into an instruction channel, and poisoned project files can steer behaviour before a developer notices. The important mechanism is not exotic exfiltration. It is normal tool use combined with overexposed data and trust in repository content that should have been treated as untrusted input.
Practical implication: Classify and isolate sensitive files before the agent ever sees them.
Why built-in approvals stop actions but not disclosure
Permission prompts, write-scope limits and network gating constrain what the agent may do, but they do not inspect the meaning of the data being moved. That creates a structural gap: an approved file read can still surface a customer record, API key or regulated document, and an approved command can still package sensitive content for outbound use. The control is therefore procedural rather than semantic. It manages action authorisation, not data classification or disclosure risk. For security architecture, that means action approval is necessary but insufficient whenever the system can read, transform and transmit information in one workflow.
Practical implication: Add content-aware controls that judge data sensitivity before an approved action can complete.
Threat narrative
Attacker objective: The attacker wants the agent to expose secrets, regulated records or developer credentials through trusted automation paths.
- Entry occurs when the agent is pointed at a repository or workspace that already contains sensitive files, config artefacts or untrusted code.
- Credential and data harvesting happen when the agent reads .env files, project settings or command output and pulls secrets into context.
- Exfiltration follows when prompt injection or poisoned project files steer the agent to move sensitive content through ordinary tool calls or outbound requests.
Breaches seen in the wild
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
- Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Claude Code security exposes a control-plane to data-plane gap: approvals govern what the agent is allowed to do, but they do not govern what the agent is allowed to move. That distinction matters because agentic coding tools operate on live repository content, shell output and connected tools, so the security decision has to happen at data-movement time. Practitioners should stop treating terminal approval as the end of the control story.
Secret exposure in coding agents is usually a governance failure, not a tooling failure: the central problem is that teams leave secrets in files and paths the agent can naturally consume. Once those values are in context, exfiltration becomes an ordinary outcome of permitted workflows, not an exceptional exploit. The specific failure mode is over-trusting repository content and under-classifying runtime data.
Agentic coding tools should be governed as high-reach non-human identities: they combine access, execution and transmission in one session, which makes them materially different from static developer tools. That means IAM, PAM and NHI controls need to converge on session-scoped authority, data classification and outbound guardrails. The practitioner takeaway is to govern the agent’s reach as tightly as any other privileged machine actor.
Content-aware controls are the named concept this category needs: action approval is not enough when the real question is whether a secret or regulated record should leave context. Security teams need policy decisions that understand file sensitivity, command intent and destination, because those three signals determine whether the agent is helping or leaking. The practitioner conclusion is to move from prompt approval to data-aware enforcement.
From our research library:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- Read next: AI Coding Agents Security Guide
What this signals
Content-aware enforcement is the missing layer for AI coding agents: organisations now need controls that evaluate file reads and outbound tool calls together, not separately. That is the point at which an agent stops being a productivity helper and starts behaving like a data-movement path that must be governed.
Claude Code exposes a broader NHI pattern: once a software actor can read, act and transmit in one session, classic approval workflows lose their value as the primary guardrail. The better programme design is to classify the data before the agent sees it and to deny movement when the content is sensitive.
The scale of the problem is already visible: Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025. That is a governance signal, not just an operational nuisance, because leakage is occurring inside ordinary development flow.
For practitioners
- Inventory agent-readable secrets and config paths Map every .env file, project config, credential store and command output path that Claude Code can reach, then remove sensitive material from locations the agent can ingest by default.
- Separate approval from disclosure control Keep permission prompts and write-scope limits in place, but add a policy layer that blocks reads or transfers of sensitive records even after an action is authorised.
- Treat repository content as untrusted input Review prompt-injection paths in dependencies, comments, README files and project settings, and assume any file the agent can read may contain steering instructions.
- Deploy content-aware DLP for agent sessions Monitor file reads, shell output and outbound tool calls together so the control can judge whether a secret or regulated record is about to leave context.
Key takeaways
- Claude Code security is fundamentally about controlling data movement in a live session, not just approving terminal actions.
- Secrets usually leak through normal development artefacts such as .env files, config files and project settings, which means governance must start before the agent reads them.
- Permission prompts help, but they do not replace content-aware controls that decide whether sensitive information should leave context.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on secrets leaking from files, configs and tool context into the agent. |
| NHI-04 — Insecure Authentication | The agent’s trust boundary depends on how it authenticates to tools and services during runtime. | |
| Recommendation — Scan agent-readable files for exposed secrets and block disclosure before the agent can transmit them. Bind agent sessions to strong authentication and limit tool access to approved identities. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article describes an agent using its assigned privileges in ways that exceed intended disclosure boundaries. |
| Recommendation — Constrain agent privileges so action approval does not become uncontrolled data movement. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is built around permissioning for file, shell and network actions. |
| Recommendation — Review agent entitlements so permissions align with the minimum access needed for each task. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | Secret theft and outbound leakage map directly to credential access and exfiltration behaviours. |
| Recommendation — Map agent leak scenarios to credential access and exfiltration tactics to guide detections and controls. | ||
Key terms
- Agentic coding assistant: An AI-assisted development tool that can decompose tasks, choose actions, and execute parts of a workflow inside the editor. In security terms, it behaves like a non-human identity when it can access code, tools, and terminals on behalf of a developer, so governance must cover its runtime behaviour.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Content-Aware Control: Content-aware control is a policy method that evaluates the actual information inside a file or transfer rather than only the application, device, or file name. It is designed to distinguish harmless business activity from the movement of sensitive data that should be restricted or logged.
- Secrets Exfiltration: The theft of credentials, tokens, API keys, or certificates from a system and their movement to an attacker-controlled location. In developer and automation environments, exfiltration is often hidden inside normal workflow activity, which makes detection and containment harder.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management and agentic AI identity. It helps practitioners design controls for software actors that can read, act and transmit in one session.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org