Topic starter
11/08/2026 3:12 pm
TL;DR: Cursor and Claude Code can read repositories, install packages, run commands, and push commits with access that often matches a senior engineer, creating new paths for source code, secrets, and customer data to leave the organisation, according to Cyberhaven. The core issue is not the model alone but the governance assumption that code assistants stay inside human-paced review loops.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “How to Secure Agentic Coding Tools: Cursor and Claude Code”.
By the numbers:
- 60.5% of organisations have adopted and are utilising AI coding assistants, according to Cyberhaven.
- Claude Code saw 6.45 daily launches per machine in 2026, versus Codex at 2.15 daily launches, according to Cyberhaven.
Key questions
Q: What breaks when agentic coding tools can read entire repositories and act on that access?
A: The review model breaks first.
Q: Why do agentic coding tools increase exfiltration risk even when employees are authorised?
A: Because authorisation to use the tool is not the same as governance over what it can see or send.
Q: How should security teams enforce policy when coding agents use MCP servers?
A: Security teams should treat MCP server access as a governed control surface, not an informal developer convenience.
Practitioner guidance
- Inventory agentic coding tools and MCP servers Build a current register of every coding agent, extension, and MCP server used on developer endpoints and CI/CD systems.
- Apply data-aware policy at the endpoint Enforce controls based on the sensitivity of the file, credential, or customer record the agent touches, not just on the application or network path.
- Limit agent visibility to least necessary repositories Separate high-risk repositories that contain production credentials, proprietary logic, or customer records from general development workspaces.
Bottom line: Agentic coding tools expand the exposure surface by combining repository access, terminal action, and model context in a single workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:26 pm
Agentic coding tools create an identity problem before they create a data problem: these tools are not passive software helpers, they are delegated actors with the ability to read, decide, and act inside development environments. That means the security question is no longer whether a developer can be trusted to use the tool, but whether the tool's delegated access is governed as a non-human identity. The practitioner implication is that coding assistants need their own access boundaries, inventory, and review model.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations separate coding agents from repositories with secrets and production data?
A: Yes, where possible. Coding agents are most dangerous when they can see everything a developer can see, including .env files, cached credentials, and production-adjacent data. Segmentation reduces the blast radius when the tool needs broad context to complete its task.
👉 Read our full editorial: Agentic coding tools expand code and secret exposure paths