Topic starter
22/07/2026 4:38 pm
TL;DR: AI coding agents now assemble context from repositories, documentation, tools, MCP servers, and skills, which expands the attack surface beyond the underlying model and makes indirect prompt injection and supply chain abuse materially more dangerous, according to HiddenLayer research. The security problem is no longer model quality alone; it is trust, provenance, and execution control across the entire agent harness.
Editorial analysis by NHI Mgmt Group, based on content published by HiddenLayer: “How Coding Agents Are Changing Application Risk”.
Key questions
Q: What breaks when an AI agent can run code on untrusted ciphertext and then act on the result?
A: The core failure is that the agent starts trusting its own runtime output more than the original untrusted input.
Q: Why do coding agents create higher risk than chatbots or copilots?
A: Coding agents create higher risk because they do work, not just answer questions.
Q: How can security teams tell whether an agent is being influenced by hostile input?
A: Look for context provenance gaps, especially when external documentation, public web pages, or issue comments shape a privileged action without clear trust tagging.
Practitioner guidance
- Constrain the agent harness as a privileged execution boundary Limit which repositories, tools, shell commands, and network destinations an agent can combine in a single task, and require explicit policy for each privileged workflow.
- Separate untrusted retrieval from privileged action Tag external documentation, issue content, and web pages as low-trust inputs until a policy engine or human review approves their use in command execution or code changes.
- Inventory MCP servers and skills as governed dependencies Track ownership, versioning, update rights, and removal paths for every remote tool, skill, and MCP server that contributes instructions or capabilities to an agent.
Bottom line: AI coding agents shift security risk from the model itself to the harness, tools, context sources, and permissions that enable runtime action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:43 pm
The decisive control problem is no longer model safety, but runtime trust composition. Coding agents combine user intent, retrieved content, tool output, and repository context into a single decision path, which means the security outcome depends on provenance and authority at every step. That is a different governance problem from testing an LLM in isolation. Practitioners should treat the harness as a control plane for delegated execution, not a harmless wrapper around a model.
A few things that frame the scale:
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC’s 2024 Generative AI Study.
A question worth separating out:
Q: Should organisations treat MCP servers as part of the identity control plane?
A: Yes. An MCP server that brokers access to secrets, models, or downstream services is effectively making authorisation decisions on behalf of machine workloads. That makes its retrieval policy, identity trust chain, and audit trail part of identity governance. If those controls are weak, the server becomes a privileged access path rather than a neutral integration layer.
👉 Read our full editorial: AI coding agents are widening application risk beyond the model