Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: Local AI agents running in developer endpoints are being adopted rapidly, but their inherited shell context, auto-approval settings, and weak visibility create a new NHI risk surface for repositories and downstream systems, according to Noma Security. The governance gap is no longer about what the model says, but what the agent can execute with existing credentials and local privileges.
NHIMG editorial — based on content published by Noma Security: local AI agents in Git repositories and the security implications of Claw-based workflows
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern local AI agents that run on developer endpoints?
A: Treat them as NHIs with identity, access, and lifecycle ownership.
Q: Why do local AI agents create more risk than browser-based AI tools?
A: Local agents can inherit endpoint permissions, active sessions, and filesystem access, which means they can execute actions directly in the development environment.
Q: What do teams get wrong about auto-approval for AI agents?
A: They treat auto-approval as a productivity setting rather than a standing authority grant.
Practitioner guidance
- Inventory every local agent as an identity Create a register of all agent installs, forks, and wrappers running on developer endpoints, including which user context they inherit and which systems they can reach.
- Remove unattended execution by default Disable auto-approval for commands that can modify files, access secrets, or reach external networks, then require explicit review for privileged actions.
- Isolate agent runtime from the host Run agents in isolated containers or sandboxed environments so they cannot access host SSH keys, local databases, or broader corporate network paths.
What's in the full article
Noma Security's full post covers the operational detail this analysis intentionally leaves for the source:
- A closer look at Claw, OpenClaw, and related agent workflows that shape the risk model.
- Specific examples of shell inheritance, directory scoping gaps, and auto-approval behaviour in local agents.
- The vendor's field observations on repository maintenance, visibility gaps, and unofficial supply-chain exposure.
- Practical recommendations for deploying isolated containers and egress allowlists in agent workflows.
👉 Read Noma Security's analysis of local AI agent risks in developer environments →
Local AI agents in Git repos: what IAM teams are missing?
Explore further
24/07/2026 4:15 pm
Privilege inheritance is the named control gap here: it was designed for a human operator whose permissions remain visible and reviewable over time. That assumption fails when a local agent executes inside the same shell context and can act immediately on active tokens, file permissions, and network reach. The implication is not simply that access needs tightening, but that identity ownership has shifted into execution time, where traditional review cycles see too little and too late.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Our research also found that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should teams do when an AI agent can access repositories and secrets?
A: Restrict the agent to a scoped runtime, separate it from the host, and review whether its access is still justified after the task ends. If the agent can read files outside the repository or reach external systems, it should be treated as a high-risk NHI subject to tighter containment and review.
👉 Read our full editorial: Local AI agents are creating a new NHI risk surface
