Scope manipulation is the new attack surface for AI coding agents

At a glance

What this is: OFFENSAI shows that AI coding agents can be manipulated through scope deception, not just prompt injection, so they attack remote targets while believing they are testing local or authorized systems.

Why it matters: This matters because security teams cannot rely on prompt wording or in-band authorization signals alone when agents are allowed to execute attack-shaped workflows against live environments.

Context

AI coding agents are now capable of carrying out offensive-style testing, but they still struggle to verify whether the target they see is the target they are actually reaching. That creates a scope integrity problem: the decision to proceed depends on environment signals that can be spoofed, rewritten, or relayed by an attacker who controls the network path.

For identity and access teams, the issue sits at the boundary between agent authorization and non-human identity governance. If an AI agent can be convinced that a remote system is local, or that a malicious relay is an approved engagement boundary, then the control problem is no longer only what the model is allowed to do, but how it proves where its actions are landing.

Key questions

Q: What breaks when an AI coding agent relies on in-band scope signals?

A: The control breaks because the same channel that carries the target description can also be manipulated by an attacker. If DNS, HTTP, MCP, or response content can be relayed or rewritten, the agent is validating a story rather than a destination. That is why scope checks must be external to the agent's own observations.

Q: Why do localhost relays create a security risk for AI coding agents?

A: Because localhost is only a label inside a network path, not proof of ownership or safety. A relay can make 127.0.0.1 point to a real remote service, so the agent believes it is testing a local app while sending payloads elsewhere. The risk is unauthorized testing against a target the operator never intended.

Q: How should security teams prevent AI agents from attacking the wrong target?

A: Security teams should require independent target attestation before an agent can run tests or send payloads. That means the host, scope, and ownership claim must be verified outside the same network path the agent is using. If the verification channel can be forged by the attacker, the control is cosmetic, not enforceable.

Q: When should organisations use out-of-band verification for agent actions?

A: Use it whenever an AI agent can send live requests, execute payloads, or run tests against any system whose ownership or exposure status matters. The more the workflow resembles offensive testing or privileged automation, the less acceptable it is to trust in-band evidence alone. Verification should happen before execution, not after.

Technical breakdown

How scope deception works in AI coding agents

Scope deception exploits the gap between what an AI agent can observe and what it can truly verify. The agent may inspect DNS resolution, TLS termination, response timing, page contents, or MCP tool answers, but all of those signals can be intercepted or rewritten before they reach a trustworthy decision boundary. In practice, a local proxy, deceptive oracle, or relayed loopback address can make a remote target appear to be a developer-owned endpoint. The agent then treats the environment as authorized because the evidence looks internally consistent, even though the TCP destination is elsewhere.

Practical implication: treat in-band authorization signals as untrusted until the target is verified out of band.

Why localhost and network relays are especially dangerous

Loopback destinations are attractive because they feel inherently safe, yet they are only labels inside a network namespace. If a tool can place a reverse proxy or relay behind 127.0.0.1, the agent may believe it is testing a local service while its payloads are forwarded to a real production site. That undermines the common assumption that localhost equals benign. The same weakness applies when a deceptive MCP server or local DNS interceptor vouches for scope, because the validation channel is controlled by the same environment the attacker can manipulate.

Practical implication: do not let loopback or local-scope labels substitute for cryptographic or out-of-band target attestation.

Why prompt hardening helps but does not solve scope integrity

A stronger system prompt can improve an agent's refusal behavior, but it does not create ground truth. The model still needs an external way to know whether its traffic is reaching the claimed host, and whether the target description matches observable behavior. That is why prompt-only defenses are brittle. They can change decisions in the moment, but they do not establish a trustworthy authorization boundary for offensive-style workflows that rely on live network observations and execution.

Practical implication: pair prompt safeguards with runtime authorization checks, attestation, and network controls that the agent cannot spoof itself.

Threat narrative

Attacker objective: The attacker wants to misdirect the agent into executing attack-shaped traffic against an unintended remote target while preserving the appearance of authorized testing.

1. Entry occurs when a developer-style prompt persuades the AI coding agent to probe a supposedly local or owned target.
2. Credential and scope trust are abused when localhost relays, deceptive MCP tools, and rewritten network responses make the environment appear authorized.
3. The agent escalates by sending attack payloads through the deceptive path to a real remote system while believing it is only testing the stated scope.
4. Impact is unauthorized offensive testing against the wrong target, including payload delivery to production systems the operator did not intend to touch.

Breaches seen in the wild

• Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Scope integrity, not prompt safety, is the real control boundary: the article shows that an agent can be given a reasonable-looking authorization story and still attack the wrong system. That means security teams should stop treating natural-language instructions as the primary trust anchor for offensive-style agent workflows. The control question is whether the agent can verify where its packets land, not whether the prompt sounded legitimate.

In-band authorization is a governance trap for AI coding agents: DNS answers, HTTP responses, MCP oracles, and page metadata all travel through channels that an attacker can influence. When those signals are used to justify execution, the agent is certifying the same evidence the attacker controls. That is a classic trust-boundary failure, and it maps directly to non-human identity governance for agentic systems.

Scope manipulation creates a distinct attack class that sits between social engineering and network interception: the article's strongest contribution is naming the problem of misleading an agent about target ownership and authorization. We would call this scope drift: the mismatch between the engagement the agent thinks it is testing and the destination its actions actually reach. Practitioners should treat it as a first-class control issue, not as a prompt-tuning edge case.

Runtime attestation must replace self-declared scope for high-risk agent actions: an AI agent that can initiate payloads needs a verifiable target boundary before it is allowed to act. That boundary belongs in policy, network enforcement, and external attestation, not in the agent's own interpretation of context. The practical conclusion is simple: if the agent can decide its own authorization story, it can also be deceived into accepting one.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Scope drift: the more capable AI coding agents become at running tests, the more value shifts to proving where their traffic is actually going. Organisations should assume that any channel the agent can inspect, the attacker can also influence, which makes loopback labels, engagement metadata, and MCP responses poor sources of trust.

As agentic workflows expand, the governance problem moves from whether a model can generate payloads to whether it can be tricked into applying them to the wrong system. That is an NHI governance issue as much as a network security issue, because the agent is acting as a non-human identity with execution authority.

The evidence here is consistent with a wider secrets and execution-risk pattern: Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025. The operational lesson is that agent safety must be enforced at the boundary where action is taken, not at the boundary where text is generated.

For practitioners

• Implement out-of-band target attestation Require a cryptographic or independently verifiable proof of target ownership before any AI coding agent can send attack-shaped payloads to a host.
• Treat localhost as untrusted by default Block agents from assuming loopback equals safe or developer-owned, especially when reverse proxies, namespace sharing, or relay tooling are present.
• Separate authorization from agent-observed evidence Move scope decisions into policy checks that the agent cannot rewrite, including explicit allowlists for hosts, paths, and test modes.
• Detect deceptive MCP and proxy layers Monitor for local MCP services, hidden reverse proxies, DNS interception, and response rewriting that can make a remote destination look legitimate.
• Constrain offensive testing to verified sandboxes Use isolated environments with known ownership and immutable boundaries before allowing agents to run pentest-style workflows against live targets.

Key takeaways

• AI coding agents can be tricked into attacking the wrong target when scope checks depend on evidence the attacker can relabel or relay.
• Loopback addresses, deceptive MCP answers, and rewritten responses create a false sense of authorization that prompt text alone cannot remove.
• The control answer is external target verification, strict policy boundaries, and sandboxing that prevents agents from self-certifying their own scope.

Key terms

• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• In-Band Authentication: In-band authentication uses the same device or channel for both the transaction and the verification step. That creates a structural weakness when the device is already compromised, because the extra code or prompt may not add real security. The approach is common, but its assurance depends heavily on the integrity of the endpoint.
• Out-Of-Band Verification: A confirmation step that uses a different channel or method than the original request. It reduces the chance that a single spoofed email, voice call, or video session can authorize privileged activity or financial transfer.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It helps security and identity teams build control boundaries for autonomous workflows that can act faster than manual review.