Coding Agent Security: What Can Go Wrong

The database is gone — what happened when an agent went wrong

The Replit incident, July 2025: what it actually means when an agent does exactly what it understands you to want.

Security as an afterthought — the Tea app breach

Researchers found textbook vulnerabilities in AI-assisted software shipped without security review. Why the mental model matters as much as the code.

Agent speed cuts both ways — the destruction asymmetry

The same property that makes agents fast makes their mistakes expensive. Understanding the asymmetry is the beginning of working safely.

Review: The cost of the wall

Three incidents, one structural lesson — and the mental model that the rest of this class builds from.

Not malicious, not cautious — the mental model that changes everything

Why 'untrusted partner' is a more useful frame than 'assistant' — and what it means for how you work.

What you handed the agent — the full permission surface

Filesystem, environment variables, shell, the web. The first step to managing access is knowing what access you gave.

The helpful agent that did exactly what you asked

Agents have no model for irreversibility. Understanding how intent and execution can diverge — and how fast.

What leaves your machine when you prompt

The context window is a data channel. Understanding what you send and where it goes is part of working with AI securely.

Prompt injection — when your content talks back to your agent

Malicious instructions can be embedded in the content your agent reads. Understanding the attack and why it is hard to defend against.

Supply chain — the package the agent just installed

Agents install dependencies. Dependencies carry their own code. Not all of it is what it claims to be.

The patterns attackers love in AI-generated code

SQL injection, missing authorization checks, hard-coded secrets. The vulnerabilities agents introduce consistently — and why they look like finished code.

The audit gap — faster than review

Agents generate code faster than humans can review it. What you are actually trusting when you ship without a full review pass.

Review: Know your surface

Four attack vectors you created when you started using a coding agent — and the mindset that closes them.

What private data actually means — and why it is always worth protecting

Private data is more than passwords. Defining the categories and understanding why a church community builder's obligations go beyond their own interests.

Never paste credentials into a chat

What happens to text you put in a model prompt — and the habit that prevents the most common credential exposure in AI-assisted development.

What the model provider sees

Understanding the data relationship with the provider: what is transmitted, what is retained, and what it means to treat the context window as semi-public.

How attackers find what you left unprotected

The Tea case revisited: what attackers look for in quickly-built products, and how fast the window between 'deployed' and 'compromised' closes.

Secrets management — keeping credentials out of the agent's reach

Environment files, secrets managers, and the architecture that keeps your most sensitive values safe even as agents have broad access to your project.

The golden rule — production and agents do not mix

The single most protective habit in coding agent security: structural separation between the environments agents can touch and the data that matters.

Least privilege — give the agent only what it needs

The principle of minimum necessary access applied to coding agent sessions: what it means, why it works, and how to implement it simply.

Branch first, merge after — the human review gate

Why every agent-produced change should live on a branch until you have reviewed it, and what to look for in a security-conscious review pass.

Backups before access

The rule that makes everything else recoverable: verify your backup strategy before you give an agent access to any data it could damage.

Dev, staging, prod — the three worlds

Why these three environments exist, what each one protects, and how to keep them separated in a solo agent-assisted workflow.

You wrote it — even if the agent typed it

Legal and ethical responsibility for agent-generated code, and what it means to own the outcome of what you ship.

A practical pre-flight checklist

The habits that compound: a short, consistent checklist that runs before every agent session and before every deployment.

The right relationship with a powerful tool

What you now know, what it gives you, and what you are ready to build.