Trust breaks because repository files can behave like instructions once an agent reads them in context. A README, manifest, hook, or error message can redirect execution, trigger commands, or expose secrets. Security teams should assume content may influence behaviour at runtime and prevent automatic command execution in untrusted projects.
Why This Matters for Security Teams
When agentic coding tools trust repository content by default, the repository stops being passive source material and becomes an active control surface. A README, build script, lockfile, or issue comment can shape what the agent does next, which is why this problem sits squarely in the agentic ai risk category described by the OWASP Agentic AI Top 10. NHIMG’s OWASP NHI Top 10 coverage also maps this to a workload identity problem, not just a code hygiene problem.
The security mistake is assuming repository content is always descriptive. In practice, agents frequently infer intent from text, execute suggested commands, and chain tools without the same skepticism a human reviewer might apply. That makes prompt injection, malicious setup guidance, and hidden instructions inside project files materially more dangerous than ordinary malformed input. Current guidance suggests treating repository content as untrusted until it is explicitly classified, sandboxed, and evaluated at runtime through policy rather than default trust. In practice, many security teams discover the issue only after an agent has already followed a poisoned instruction path or exposed a secret from a trusted context.
How It Works in Practice
Defensive design starts with a simple rule: repository files can inform an agent, but they should not implicitly authorise an action. That means separating content ingestion from command execution, and requiring explicit approval for any step that writes code, modifies infrastructure, or retrieves secrets. The NIST AI Risk Management Framework is useful here because it pushes teams toward govern, map, measure, and manage decisions instead of trusting model behaviour to remain bounded.
In operational terms, teams should combine least privilege with runtime policy checks. A code agent should authenticate as a workload identity, not as a human developer, and receive short-lived access only for the task at hand. That aligns with guidance in CSA MAESTRO agentic AI threat modeling framework, which treats tool use, memory, and external actions as distinct decision points.
- Block automatic execution of repository-supplied commands unless the source is trusted and policy-approved.
- Use sandboxed runs for dependency installation, tests, and code generation.
- Evaluate each tool call against policy-as-code at request time, not only at session start.
- Issue just-in-time credentials with short TTLs and revoke them immediately after task completion.
- Log the exact repository content that influenced an agent decision for later review.
NHIMG’s Analysis of Claude Code Security and Amazon Q AI Coding Agent Compromised both illustrate the same failure mode: the agent treats untrusted project content as operational guidance. These controls tend to break down in monorepos and CI environments where scripts, templates, and generated artifacts are all mixed together because provenance becomes unclear.
Common Variations and Edge Cases
Tighter repository trust controls often increase friction for developers, requiring organisations to balance fast automation against the risk of unsafe execution. That tradeoff becomes sharper in environments with many third-party dependencies, community contributions, or AI-generated code, where the agent may encounter legitimate instructions alongside malicious ones. Best practice is evolving, and there is no universal standard for this yet, especially for deciding how much context an agent may safely inherit from a repository.
Edge cases matter. A benign-looking dependency update can hide a setup script that alters agent behaviour. A poisoned comment in a pull request can influence a review agent. A status message from a build system can become a covert instruction channel if the agent is allowed to act on it. The safer pattern is to classify repository inputs by provenance, separate “read” from “act,” and use explicit human approval for any step that changes trust boundaries. This is also where OWASP Agentic Applications Top 10 remains especially relevant: prompt injection and tool misuse are not isolated bugs, they are structural risks in autonomous workflows.
Where teams need a practical rule, the best current guidance is to assume repository content is advisory only until policy, provenance, and execution context all agree. That stance is particularly important in highly automated CI/CD systems that allow agents to open shells, access secrets managers, or promote code without a human checkpoint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Repository trust by default enables prompt injection and unsafe tool use. |
| CSA MAESTRO | T1 | MAESTRO addresses tool-use risk in agentic workflows and coding agents. |
| NIST AI RMF | GOVERN | AI RMF governs accountability for autonomous behaviour and unsafe inference. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Agents need workload identity controls, not implicit repo trust. |
| NIST Zero Trust (SP 800-207) | 3.1 | Zero trust requires explicit verification for every repository-driven action. |
Never trust repository content alone; verify context and authorisation on each request.
Related resources from NHI Mgmt Group
- What breaks when AI assistants are allowed to trust repository content by default?
- What breaks when PDF readers are allowed to execute active content by default?
- What breaks when remote support tools are treated as normal user software?
- What breaks when shadow MCP servers are allowed into agent workflows without review?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
