Notifications
Clear all
Topic starter
11/08/2026 3:12 pm
TL;DR: Cursor and Claude Code can read repositories, install packages, run commands, and push commits with access that often matches a senior engineer, creating new paths for source code, secrets, and customer data to leave the organisation, according to Cyberhaven. The core issue is not the model alone but the governance assumption that code assistants stay inside human-paced review loops.
NHIMG editorial — based on content published by Cyberhaven: How to Secure Agentic Coding Tools: Cursor and Claude Code
By the numbers:
- 60.5% of organizations have adopted and are utilizing AI coding assistants.
- Claude Code saw 6.45 daily launches per machine in 2026, versus Codex, which saw only 2.15 daily launches.
- source code is the number one data type submitted to unauthorized AI models, at 28%, nearly double the next category.
Questions worth separating out
Q: How should security teams govern coding agents that can execute repository instructions?
A: Treat repository instruction files as executable input, not documentation.
Q: Why do agentic coding tools create a different risk profile from standard developer tools?
A: They collapse reading, reasoning, and execution into one workflow.
Q: What breaks when MCP connections are added to coding assistants without review?
A: The trust boundary expands beyond the repository into ticketing systems, databases, wikis, and external APIs.
Practitioner guidance
- Inventory every coding agent and MCP connection Build a live register of Cursor, Claude Code, and any connected MCP servers on developer endpoints and CI/CD systems.
- Restrict agent reach to the minimum repository scope Limit which repositories, branches, and local files each agent can inspect, especially .env files, cached cloud credentials, and fixtures that contain customer data.
- Apply endpoint data policy before model submission Use data-aware policy at the endpoint so the file, credential, or customer record is classified before it can be included in a prompt or transmitted to a hosted model.
What's in the full article
Cyberhaven's full blog covers the operational detail this post intentionally leaves for the source:
- Endpoint-native Data Lineage implementation details for tracing files, credentials, and customer records through agent interactions
- How Linea AI classifies data in context and decides whether to block, warn, or allow an agent action
- Visibility into MCP servers and shadow AI agents across developer machines and CI/CD pipelines
- How policy follows sensitive data instead of relying on process-name allowlists
👉 Read Cyberhaven's analysis of how to secure agentic coding tools →
Agentic coding tools and MCP access: are your controls keeping up?
Explore further
11/08/2026 3:26 pm
Agentic coding tools are non-human identities with developer-grade reach, not just productivity features. Once a tool can open files, inspect repositories, call external services, and push commits, it becomes part of the identity plane. That means IAM, PAM, and data security controls must evaluate the agent's effective reach, not the user's intent alone. Practitioners should treat these tools as governed executors, not as passive copilots.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: How do organisations reduce data leakage from agentic coding tools without banning them?
A: Use approved agents with endpoint data policy, repository scoping, and monitored MCP access so the secure path is also the easiest path. Blocking the tools outright usually pushes developers toward unmanaged accounts and extensions. The better control is to make access specific, observable, and revocable.
👉 Read our full editorial: Agentic coding tools expand code and secret exposure paths
