Windsurf security risks expose the gaps in AI coding governance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: Windsurf's agentic editor architecture creates a broader governance problem than a normal IDE because code can move off-device, tools can be invoked through MCP, and terminal actions can run with limited review.

Why it matters: IAM, PAM, and NHI teams should treat AI coding tools as governed execution environments, not just developer productivity software, because runtime control and policy visibility now matter as much as storage settings.

Context

Windsurf is an AI-native code editor that combines source-code editing with agentic execution, external tool access, and automated terminal actions. That changes the security problem from protecting an editor to governing a system that can move code, invoke tools, and act while a developer is still in the loop.

For IAM and security teams, the governance gap is not just whether data is stored securely. It is whether AI coding activity has policy, visibility, and containment while the assistant is connected to MCP servers, extension ecosystems, and runtime actions.

The article frames Windsurf as a case where legacy browser-era controls and storage-only settings are too narrow for the actual behaviour of AI coding assistants. That is a familiar pattern in identity governance: controls built for passive tools break when the system starts executing tasks and chaining privileges in context.

Key questions

Q: What breaks when AI coding tools can turn untrusted content into shell commands?

A: The approval model breaks. If markdown, comments, or embedded instructions can influence execution, then allow-lists and approval prompts no longer validate human intent. The control failure is a trust boundary mismatch between text parsing and command execution, which means a malicious repository or document can trigger actions the user never knowingly authorised.

Q: Why do AI coding assistants create compliance and audit risk?

A: They create compliance and audit risk because they can generate code and process inputs outside traditional review paths. If organisations cannot show who used the assistant, what data was exposed, and how outputs were approved, they lose the evidence needed for audits, incident review, and regulatory accountability. The risk grows quickly when assistants are allowed near sensitive logic or regulated data.

Q: What are the signs that an AI coding environment is becoming overexposed?

A: Look for unsanctioned MCP servers, auto-execution enabled by default, extension packages with broad file or network reach, and prompt traffic that includes secrets or source code. Those are indicators that the editor has become a runtime trust surface rather than a bounded developer tool.

Q: How should teams compare ZDR mode with full AI coding governance?

A: ZDR mode reduces one class of persistence risk, but full governance also needs visibility into transmission, tool delegation, and runtime actions. The comparison is not between two product settings. It is between partial data handling control and end-to-end operational oversight of the AI coding workflow.

Technical breakdown

Why agentic code execution changes the trust model

Windsurf’s Cascade engine does more than autocomplete. It decomposes a coding task into subtasks and delegates them to agents that can execute terminal commands, access files, and connect to external tools. That makes the security boundary behavioural, not just architectural. Traditional IDE security assumes the developer decides every action and the tool only assists. Agentic execution breaks that assumption because the system can select actions mid-task, including tool calls and command execution, before a human reviews each step. Practical implication: security teams need controls that inspect and govern execution at runtime, not just after code is saved.

Practical implication: govern AI coding tools where they act, not only where they store data.

How MCP expands the attack surface in AI coding tools

Model Context Protocol, or MCP, lets an AI application connect to external services and tools through standardised servers. In an IDE context, that creates a new trust layer between the editor and the systems it reaches. If an attacker can alter local MCP configuration or register a malicious server, the agent may inherit an unsafe execution path that looks legitimate from the editor’s point of view. This is not a classic plugin problem alone. It is an identity and authorisation problem, because tool access is being delegated dynamically to a runtime component. Practical implication: MCP servers need inventory, approval, and monitoring as governed integrations.

Practical implication: treat MCP servers as governed integrations with explicit inventory and approval.

Why extension ecosystems and published CVEs matter together

Windsurf’s risk is compounded by the combination of documented vulnerabilities and supply chain activity in its extension ecosystem. A path traversal issue, arbitrary command execution through MCP configuration changes, and malicious packages targeting users all point to the same pattern: the editor is only as safe as the trust placed in its execution path and add-on chain. Extension ecosystems are especially dangerous when they can reach source code, secrets, and model prompts in the same environment. Practical implication: security teams should assess editor extensions and related packages with the same scrutiny they apply to other software supply chain dependencies.

Practical implication: apply supply-chain review to editor extensions and packages that can touch code or secrets.

Threat narrative

Attacker objective: The attacker wants to turn an AI coding environment into a trusted execution path for stealing secrets, running commands, or planting malicious tooling.

1. Entry occurs through a vulnerable AI coding editor, a malicious extension, or a compromised MCP configuration that reaches the local development environment.
2. Credential and code access follow when the tool can read local files, including environment files, API keys, and proprietary source code.
3. Escalation happens when the agent is induced to invoke commands or register a malicious tool without human approval.
4. Impact is the theft of secrets, unauthorised code execution, or the spread of supply chain compromise through the developer workflow.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI coding assistants are no longer just development tools; they are governed execution environments. Windsurf’s combination of agentic task decomposition, terminal execution, and external tool access moves the control problem out of the browser-era DLP model and into runtime governance. That means the relevant question is not whether code was stored safely, but whether the system’s actions were policy-bound while work was in flight. Practitioners should treat AI coding workflows as part of identity and access governance, not as a separate productivity layer.

Runtime controls matter more than storage controls when code is actively moving through agents. Zero Data Retention can reduce one form of exposure, but it does not address code transmission, tool invocation, or unauthorized command execution. The core problem is that the risk exists before data is stored anywhere. Security teams should stop treating persistence settings as a proxy for governance maturity and start asking whether they can observe and constrain AI actions in real time.

Micro-permissioning for developer AI is now a governance requirement, not an optimisation. When an AI editor can connect to external tools, invoke shell actions, and interact with extension chains, the blast radius of a single approval mistake grows quickly. That makes AI coding posture part of privileged access management by another name. Practitioners should re-evaluate who can enable agentic features, what tool connections are allowed, and how exceptions are recorded.

The new named concept is agentic code trust debt. The longer organisations allow AI coding assistants to operate without inventory, policy, and runtime oversight, the more hidden trust they accumulate in toolchains they cannot fully explain. That debt shows up later as compliance gaps, secret exposure, and unreviewable command paths. Security leaders should treat every unmanaged AI coding workflow as deferred governance risk.

Compliance exposure is created by the workflow, not just the model. AI coding assistants can alter code, move data to external infrastructure, and leave weak evidence trails even when the underlying model is compliant in isolation. That means legal, procurement, and security teams need to assess the full editor-to-model-to-tool chain. Practitioners should align governance to where the work happens, not to where the vendor says training stops.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
• Read next: Top 10 Agentic AI Identity Issues

What this signals

Agentic code trust debt: AI coding environments that can execute commands and reach external tools accumulate hidden trust faster than legacy developer controls can account for. The practical shift for security teams is to treat editor workflows as governed execution paths, not passive authoring surfaces.

The next governance step is to inventory where AI coding tools are already in use, then align those workflows to privileged access, secret handling, and audit expectations before agentic features spread further across the engineering estate.

For practitioners

• Discover every AI coding workflow in use Inventory Windsurf and other AI-native development tools across engineering teams, including who uses them, which projects they touch, and whether agentic features are enabled.
• Restrict terminal auto-execution defaults Set the maximum permitted auto-execution level to the lowest acceptable setting and require explicit approval for commands that can modify files, secrets, or deployment paths.
• Approve MCP servers as managed integrations Require review of every MCP server connection, track configuration changes, and revoke trust when a server can reach code, secrets, or production-adjacent systems.
• Classify developer prompts and outputs in context Apply policy that recognises when prompts contain source code, API keys, customer data, or regulated information, then route or block those interactions at runtime.
• Tie AI coding use to compliance obligations Map AI-assisted development against disclosure, records, and internal-control requirements so that code changes, approvals, and data movement remain auditable.

Key takeaways

• AI coding assistants now behave like governed execution environments because they can move code, call tools, and run commands during active work.
• The article’s evidence includes published CVEs, malicious extension activity, and MCP-related exposure that together widen the developer attack surface.
• The limiting control is no longer storage alone. Practitioners need runtime visibility, tool approval, and policy enforcement across the full coding workflow.

Key terms

• Agentic Code Environment: A development environment where the AI assistant can break down work, invoke tools, and execute actions during the coding task. In governance terms, it behaves more like a controlled execution surface than a passive editor, so access, approvals, and monitoring have to follow the runtime, not just the saved file.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• Agentic Code Trust Debt: The accumulated risk created when organisations allow AI coding assistants to operate with hidden or loosely governed trust relationships. It builds over time through unmanaged tool access, weak approvals, and incomplete audit evidence, then surfaces as compliance gaps, secret exposure, and unclear command paths.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.