Coding agents fail when facts go stale between read and action

At a glance

What this is: This is a Backslash Security analysis showing that coding agents can execute ordinary tasks against stale world state and still produce destructive results.

Why it matters: It matters to IAM and NHI practitioners because agent governance depends on time-bound access, current context, and re-validation of what an agent is actually acting on.

By the numbers:

• In its experiment, Sonnet 5 wrote the stale database host in 11 of 12 runs, while Opus 5 did so in 1 of 12.
• In the strongest stale-secret scenario, Opus 5 wrote the retired API key into the deploy script in 12 of 12 runs.

👉 Read Backslash Security's analysis of stale context in coding agents and production risk

Context

Coding agents fail when the value they read is no longer true by the time they act. The harness can only enforce what it re-checks, so any branch switch, config change, or secret rotation that happens after the read creates a governance gap between intent and execution. For identity teams, that gap is familiar: standing access and stale authorization both become dangerous when they outlive the state they were granted against.

The article is really about control boundaries, not model personality. When an agent reasons from a stale description of files, branches, or environment values, the failure mode resembles an identity system making decisions on outdated entitlement data. That is why NHI governance, secrets handling, and runtime validation belong in the same design conversation rather than separate operational silos.

Key questions

Q: What breaks when a coding agent loses context during a long session?

A: The agent can start optimising for the wrong goal, repeat tool calls, or produce code that fits the local test but violates the broader requirement. Context loss also weakens governance because the system can no longer preserve policy intent across the full execution path. That is why context-window utilisation should be monitored as a control signal.

Q: Why do agent approval gates miss runtime risk?

A: Approval gates usually inspect the command or request, not the environment value that command resolves to when it runs. If the branch, host, or secret changes after the read, the gate can approve a stale decision that now points somewhere else. The control must validate the resolved target, not only the instruction string.

Q: How should security teams handle context changes in coding agents?

A: They should force a fresh read whenever the agent crosses a branch, file, or environment boundary, and again immediately before any destructive or privileged action. That reduces the window in which stale facts can drive execution. In practice, context changes need to be treated like identity state changes.

Q: When does a coding agent become unsafe even without an attacker?

A: It becomes unsafe when the world changes after the agent has already formed its plan and nothing in the harness forces it to re-check. That can happen during normal development, deployment, or cleanup work. The risk is highest when the command is routine, because routine commands get less scrutiny than obvious destructive ones.

Technical breakdown

Why stale context breaks coding agents

A coding agent is not observing the machine directly. It receives a turn-by-turn text description assembled by the harness, then produces an action based on that snapshot. If a file, branch, or secret changes after the read, the model has no intrinsic way to notice. The result is not random behaviour but a deterministic decision made against an obsolete state. In security terms, this is a time-of-check versus time-of-use problem translated into agentic workflows.

Practical implication: force re-validation of any value that can change between read and write.

How harness checks catch some failures but miss others

The article distinguishes surfaced divergences from silent ones. If the harness notices a file changed since it was read, it can block the write and require a fresh read. But when the agent reads one source and writes to another, or when a command resolves differently at runtime, the guardrail never compares the original fact to the eventual action. That means the control is only effective when the same object is being re-used, not when the value is propagated across files or commands.

Practical implication: extend controls beyond file-level guards to cross-file and command-resolution checks.

Why agent permissions are only part of the control model

The article shows that approval gates do not solve stale-decision risk by themselves. A reviewer or rule can inspect a command string, but not necessarily the environment value, database target, or rotated secret that command will resolve at execution. That is why the meaningful control is not simply permission to act. It is permission coupled with fresh context, explicit resolution of the target, and a last-mile check that the environment still matches the decision basis.

Practical implication: require agents to state what a command resolves to before approval and execution.

Threat narrative

Attacker objective: The practical attacker objective is not compromise in the traditional sense but inducing the agent to perform high-trust actions against the wrong live asset.

1. Entry occurs when the agent reads an apparently correct configuration or branch state from the harness.
2. Escalation happens when the machine changes underneath the agent and the model continues to act on the older description.
3. Impact follows when the agent executes a destructive or sensitive action against production, a retired secret, or the wrong deployment target.

NHI Mgmt Group analysis

Stale context is now an identity control problem, not just a model quality problem. When an AI coding agent acts on a value that has already changed, the failure sits in the governance layer between read, decision, and execution. That is the same structural issue identity teams face when access decisions are made on stale lifecycle data. The practitioner takeaway is that runtime validation has to sit inside the control path, not after the fact.

Context freshness is a named control surface that security teams need to design deliberately. The article makes clear that the dangerous gap is not lack of permission, but permission applied to an out-of-date world model. That creates a distinct governance concept: context freshness. In NHI and agentic AI programmes, this should be treated as a measurable control boundary alongside secrets rotation, access review, and task-scoped privilege.

Harness design determines whether agent risk is visible or silent. A body that re-reads changed files can surface divergence, while a body that only forwards commands leaves the model free to act confidently on stale assumptions. That distinction matters for broader AI governance because it shows why the same model can be safe in one environment and dangerous in another. For practitioners, the unit of control is the agent system, not the model alone.

Agentic systems collapse the assumption that approval equals safety. The article shows that an approval gate that sees only a command string misses the actual risk, which is the target that command resolves to at runtime. For identity architects, that mirrors why static entitlements are insufficient for ephemeral execution contexts. The right governance model is validation at use, not only authorization at request.

Operational drift will become the dominant failure mode in agentic workflows. As more work is delegated to coding agents, the most common incident will be an ordinary task executed against an ordinary but outdated fact. That is a governance maturity issue, not a novel attack technique. Teams should classify stale-context execution as a first-order control risk and build policy around it.

What this signals

Context freshness will become a formal control requirement for agentic workflows. Once agents can read, plan, and act across changing repositories or environments, static approval is no longer enough. Teams should expect policy to shift toward re-validation at execution time, especially where agent actions can reach production systems, secrets, or deployment pipelines.

Context freshness is the named concept practitioners should operationalise. It means the agent's working description of files, branches, and environment state must be current at the moment of action. That concept belongs alongside secrets rotation and access review in identity-aware engineering programmes, because stale context creates the same kind of silent drift that stale entitlements do.

Identity teams should align agent governance with the NHI lifecycle, not with model prompts alone. If the surrounding harness does not re-check what changed, the agent will act on an obsolete permission context. This is where NHI governance, runtime validation, and production change control need to converge.

For practitioners

• Enforce last-mile re-reading for mutable values Require the agent to re-read any file, branch, or configuration value immediately before it writes or executes against it, especially when that value can change between turns.
• Expose command resolution before approval Make the agent state the resolved target, environment, or secret source in plain text before a privileged command is approved so reviewers can evaluate what the command will actually hit.
• Separate source reads from destination writes with explicit checks Add harness logic that compares the value the agent consumed with the object it is about to modify, rather than only checking whether the destination file changed since it was read.
• Reset agent context after branch or environment changes Treat every git checkout, pull, or environment switch as a fresh session boundary so the agent cannot continue reasoning from a world that no longer exists.

Key takeaways

• Coding agents can fail safely on the surface and still act destructively when the world changes underneath them.
• The strongest signal in the article is not model unpredictability but the control gap between a stale read and a live action.
• Practitioners should design for re-validation at execution time, because that is where stale context turns into real impact.

Key terms

• Stale Context: Stale context is the outdated description of the world that an AI agent uses to plan and act. In coding workflows, it usually means branch state, file contents, environment values, or secrets that changed after the agent read them but before it executed an action.
• Harness: The harness is the layer of instructions, policies, and approval logic wrapped around an AI agent. It is where organisations try to constrain behaviour, but it only works if the rules are explicit, current, and enforced outside the model itself.
• Identity Freshness: Identity freshness is the degree to which the governance system reflects the live state of accounts, groups, entitlements, and credentials. It is not just a performance metric. In practice, freshness determines whether access reviews, approvals, and offboarding actions are based on reality or on a delayed snapshot.
• Resolution Check: A resolution check confirms what a command, reference, or variable will actually point to when it runs, not just what the instruction text says. For agentic workflows, this closes the gap between a safe-looking request and the live target it will affect.

What's in the full report

Backslash Security's full analysis covers the operational detail this post intentionally leaves for the source:

• Measured batch-by-batch drift results across Claude Sonnet 5 and Opus 5 in the cleanup, config, host, and secret scenarios
• The exact harness setup, branch-switch sequence, and control-run design used to separate genuine drift from baseline behaviour
• The recovery pattern where Opus re-read state at action time and avoided or reversed the production wipe in several runs
• The full FAQ spread on why auto mode, model size, and approval rules did not remove the underlying gap

👉 Backslash Security's full post covers the experiment design, failure cases, and recovery behaviour in detail

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management. It helps practitioners build the control model needed when runtime decisions depend on fresh context.