AI coding agents are useful because they can interact with real software delivery systems. That is also why they introduce security risk. An agent that can read repositories, run commands, install packages, call tools, and open pull requests sits inside the engineering attack surface.
Security teams do not need to block every AI coding workflow. They do need a control model before the workflow scales.
Risk 1: Overbroad Repository Access
Agents often need repository access to be useful. They do not need access to everything.
Controls:
- approve repositories explicitly
- scope tokens to the target repository
- separate read-only context access from write access
- block direct writes to protected branches
- require PR/MR handoff for all production changes
- review access regularly
Treat agent access like service access, not like a trusted developer laptop.
Risk 2: Prompt Injection Through Code and Issues
Agents read untrusted content: issue comments, markdown docs, repository files, test fixtures, and sometimes user-generated content. That content can include instructions that try to redirect the agent.
Controls:
- treat repository and issue content as data, not authority
- define trusted instruction sources such as repository rules
- restrict tool permissions
- log tool calls
- require validation before branch handoff
- block secret exposure to prompts and outputs
The OWASP Top 10 for LLM Applications is a useful reference for prompt injection, sensitive data exposure, excessive agency, and related risks.
Risk 3: Secrets in Logs or Prompts
Agents may run commands that print environment variables, package tokens, URLs, or stack traces. Logs and PR/MR summaries can then expose data.
Controls:
- redact known secret patterns from logs
- avoid passing secrets into agent-visible environments unless required
- use short-lived credentials
- separate validation credentials from production credentials
- prevent prompts and summaries from including command output that may contain secrets
- audit failed runs as well as successful ones
Secret isolation should be part of the worker design, not a note in a handbook.
Risk 4: Unsafe Tool Execution
Coding agents often run shell commands, install dependencies, execute tests, and call code-host APIs.
Controls:
- run agents in sandboxed environments
- restrict network egress
- limit command categories where practical
- record commands and outcomes
- block destructive commands unless explicitly approved
- clean workspaces between runs
If an agent can run arbitrary commands with broad credentials, your threat model has changed.
Risk 5: Dependency and Supply Chain Changes
AI can suggest packages that are outdated, unmaintained, maliciously named, or unnecessary.
Controls:
- require reviewer approval for new dependencies
- run dependency scanning
- prefer existing internal packages and helpers
- block package-manager lockfile changes unless in scope
- require explicit PR/MR notes for dependency changes
Dependency changes should not hide inside a broader generated diff.
Risk 6: CI/CD Abuse
AI-generated branches can trigger workflows. Those workflows may have secrets, deployment rights, or expensive compute.
Controls:
- limit which workflows run on agent branches
- use safe defaults for fork-like or bot-created branches
- separate validation from deployment
- require human approval for production deploy workflows
- monitor unusual CI usage from agent-created branches
Cloud Security Alliance research has highlighted AI coding tools and developer toolchains as an expanding attack surface. Treat CI/CD access as a core part of agent security.
Risk 7: Weak Audit Evidence
If a security incident involves AI-assisted code, teams need evidence quickly.
Retain:
- source ticket or issue
- initiating user
- repository and branch
- provider/model path where available
- context sources used
- commands run
- validation outcomes
- created PR/MR
- review and merge history
MergeLoom’s audit trails and attribution are designed around this evidence path.
Security Rollout Checklist
Before scaling AI coding agents, confirm:
- approved tool list exists
- repository access is scoped
- branch protection remains enforced
- secrets are isolated and redacted
- agent execution is sandboxed
- network egress is controlled
- dependency changes are flagged
- validation runs before review
- human approval is required
- run evidence is retained
This checklist will not remove every risk. It will make the risk visible enough to manage.
FAQ
Question: Are AI coding agents inherently unsafe?
Short answer: No. They are powerful automation with real access. The risk depends on permissions, execution boundaries, validation, review, and audit controls.
Question: What is the most important first control?
Short answer: Least-privilege repository and credential access, combined with PR/MR-only handoff and human review.
Question: Does self-hosting solve these risks?
Short answer: It can improve boundary control, but you still need sandboxing, secret handling, provider rules, validation, and audit evidence.