Topic starter
22/07/2026 4:35 pm
TL;DR: Coding agent attacks can stay entirely within authorized boundaries while still exfiltrating data or changing goals, and Zenity’s research says 47% of organisations have already experienced an AI agent security incident. Permission controls alone cannot prove appropriateness, which makes intent observability and least agency the missing layer.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “The Permission Boundary Myth: Why Authorized Doesn't Mean Appropriate for Coding Agents”.
By the numbers:
- 47% of organizations have already experienced an AI agent security incident, and most didn't see it in their existing tooling.
Key questions
Q: What breaks when coding agents stay within permission boundaries but still do the wrong thing?
A: The failure is that authorization alone cannot prove appropriateness.
Q: Why does prompt injection create risk even when credentials are valid?
A: Prompt injection works because the agent uses its own authorised access.
Q: How can security teams tell whether a coding agent is actually behaving safely?
A: They need to measure whether the agent’s action sequence still matches its declared task.
Practitioner guidance
- Define task-scoped autonomy boundaries Separate what a coding agent may access from what it may decide to do autonomously, and require explicit oversight for multi-step actions that can compound into data exposure or destructive change.
- Instrument intent observability Capture the reasoning context, goal state, and decision trajectory for agent sessions so you can spot goal drift, injected instructions, and anomalous action sequences that look permitted in isolation.
- Harden prompt ingestion paths Treat untrusted markdown, issues, and documentation as potential instruction carriers, and restrict which repositories, documents, and external sources can shape an agent’s context.
Bottom line: Coding agents can remain within authorized permissions and still create security incidents, which makes pure access control an incomplete governance model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:40 pm
Authorized is not the same as appropriate: coding agents expose a governance failure that IAM alone cannot close. Permissions can prove reach, but they cannot prove that the resulting action chain matched the task that was intended. The practitioner implication is that coding-agent governance must evaluate behavior, not just entitlement.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between least privilege for humans and least privilege for AI agents?
A: Human least privilege usually maps to a job role, while AI-agent least privilege must map to a task, a time window, and a specific allowed action. Agents often combine planning and execution in one workflow, so broad roles are too loose. The practical standard is short-lived, operation-specific access with a clear stop condition.
👉 Read our full editorial: Authorized does not mean appropriate for coding agents