Autonomous AI coding agents — tools like Claude Code, Cursor’s agent mode, and Copilot workspace agents — can now read a codebase, write and run code, call external tools, and open pull requests with minimal human intervention. That autonomy is exactly what makes them productive, and exactly what makes them a new class of security risk. OWASP’s own guidance tracks this: in its GenAI Security Project’s 2026 update, prompt injection held the number-one spot for a third straight year, and “excessive agency” — the risk of a model having too much functionality or too many permissions — jumped from eighth to third place as agentic tool use has spread. This piece explains the core risks and gives a practical checklist for running coding agents safely.
At a Glance: Top Risks and Mitigations
| Risk | What It Means for a Coding Agent | Primary Mitigation |
|---|---|---|
| Prompt Injection (OWASP LLM01) | Malicious instructions hidden in a file, README, issue comment, or fetched webpage change the agent’s behavior | Treat all retrieved content as untrusted data, never as instructions; sandbox and scope tool access |
| Excessive Agency (OWASP LLM06) | The agent has broader permissions or tool access than the current task needs (e.g., it can both read and delete files) | Least-privilege permission scoping per task/session; approval gates for destructive actions |
| Sensitive Information Disclosure (OWASP LLM02) | Agent reads or echoes credentials, API keys, or secrets it encounters while browsing a repo or terminal output | Secrets management outside the agent’s reach (vaults, env injection at runtime), output filtering |
| Supply Chain (OWASP LLM03) | Agent installs or runs a malicious dependency, plugin, or MCP server it was tricked into trusting | Pin and review dependencies/tools; restrict which registries and MCP servers an agent may use |
| Improper Output Handling (OWASP LLM05) | Agent-generated code or shell commands execute without review and introduce injection or logic flaws | Human-in-the-loop review before merge/deploy; automated static analysis gates in CI |
What Prompt Injection Actually Is
OWASP’s Top 10 for LLM Applications defines a prompt injection vulnerability as occurring when user or external input alters a model’s intended behavior in a way the developer did not anticipate — including input the model retrieves on its own, such as a web page, a file, or a tool’s output. It has been ranked the number-one LLM risk in OWASP’s list for three consecutive editions. As Steve Wilson, co-chair of the OWASP GenAI Security Project, has put it, large language models “cannot differentiate between data and instructions” the way traditional software can, which is why OWASP frames prompt injection as something to be continuously managed rather than a bug that can be definitively patched the way SQL injection can.
For a coding agent, this risk is concrete and not theoretical: a comment in a GitHub issue, a string inside a dependency’s README, or text embedded in a web page the agent fetches while researching a bug can all contain instructions crafted to hijack the agent — for example, telling it to exfiltrate a secret, modify a CI config, or install a malicious package, phrased as if it were part of the legitimate task.
Why Agentic Tool Use Raises the Stakes
OWASP’s LLM06 category, Excessive Agency, covers what happens when a model is given more functionality, more tool access, or more autonomous decision-making power than a task requires. In OWASP’s 2026 update, this category rose to third place, up from eighth two editions earlier — a shift OWASP’s own co-chair attributes directly to AI systems now being able to browse the web, call external tools, and reach into business systems on their own. A coding agent that only needs to read a repository but is also wired up with file-delete, network-access, or production-deployment tools turns a single successful prompt injection into a much larger incident. OWASP’s suggested mitigation is explicit: tightly scoped permissions combined with continuous behavioral monitoring, rather than assuming the model will simply “know” not to misuse a capability it has been handed.
OWASP has also launched a dedicated Agentic Security Initiative (ASI), publishing threat-modeling guidance specifically for agentic systems and mapping it to established frameworks such as MITRE ATLAS, CWE, and NIST — a signal that agentic risk is now treated as its own discipline rather than a subset of general LLM security.
The Checklist: Deploying Coding Agents Safely
- Sandbox execution. Run the agent’s shell, code execution, and file access inside a container or VM that is isolated from production credentials, your broader network, and other developers’ environments — never on a developer’s primary machine with full access.
- Scope permissions per task, not per project. Grant only the tools and filesystem/network access a specific task needs (e.g., read-only repo access for research tasks; write access only for the specific directory being edited), and treat any request for broader access as something to approve explicitly, not assume.
- Treat all fetched content as untrusted data. Web pages, issue comments, dependency READMEs, and tool outputs the agent reads should never be able to directly trigger privileged actions — apply the same mistrust you’d apply to unsanitized user input in a web app.
- Keep secrets out of the agent’s reach. Inject credentials at the point of use via a secrets manager or short-lived tokens rather than placing them in files, environment dumps, or chat history the agent can read, log, or echo back.
- Require human-in-the-loop review for anything destructive or externally visible. Code merges, deployments, infrastructure changes, and any action that sends data outside the sandbox (network calls, package installs, PR creation to public repos) should require explicit human approval, not run on autopilot.
- Pin and vet tools, plugins, and MCP servers. Only connect agents to tool integrations (including Model Context Protocol servers) that have been reviewed, and pin versions rather than letting an agent dynamically discover and install new ones mid-task.
- Run static analysis and dependency scanning on agent-generated code. Don’t exempt AI-authored commits from the same SAST/SCA gates applied to human-authored code — agents can introduce the same vulnerability classes, and prompt injection can specifically aim to make them do so.
- Log and monitor agent actions continuously. Keep an audit trail of every tool call, file change, and command the agent executes, so an injected or misbehaving session can be detected and rolled back quickly.
- Set hard limits on resource and API consumption. OWASP’s Unbounded Consumption category (LLM10) applies to agents too — cap how many tool calls, tokens, or cloud resources a single agent session can use to limit the blast radius of a runaway or hijacked loop.
- Review system prompts and configuration for leakage risk. Agent instructions and internal tool definitions can themselves be exposed (OWASP’s System Prompt Leakage, LLM07); avoid embedding secrets or overly sensitive business logic directly in system prompts.
Trade-Offs to Expect
Every mitigation above trades some agent autonomy for safety, and that trade-off is the point, not a flaw. Tight permission scoping and mandatory human review will slow an agent down and reduce the “fire and forget” appeal that makes these tools attractive in the first place. Sandboxing adds infrastructure overhead. Treating all external content as untrusted will occasionally cause an agent to ask for clarification on something genuinely benign. Teams that skip these controls to move faster are accepting the same prompt injection and excessive-agency risks that OWASP has ranked at the top of its list for three years running — the checklist above is about managing that risk deliberately rather than eliminating friction by accident.
Bottom Line
Prompt injection cannot be fully “patched” the way a traditional vulnerability can — OWASP itself frames it as a risk to be continuously managed. For teams running autonomous coding agents, that means defense-in-depth: sandboxed execution, least-privilege permission scoping, secrets kept outside the agent’s reach, mandatory human review for destructive or externally-visible actions, and the same static analysis and dependency scanning you’d apply to any other code, applied without exception to agent output.
FAQ
Is prompt injection the same as a jailbreak?
They’re related but distinct. A jailbreak typically targets the model’s own safety guardrails directly in the conversation; prompt injection more broadly covers any input — including content the model retrieves on its own from a file, webpage, or tool output — that changes its behavior in unintended ways. OWASP’s Prompt Injection category covers both.
Can sandboxing alone solve the problem?
No. Sandboxing limits the blast radius of a compromised agent session, but it doesn’t stop prompt injection from happening — an injected agent can still exfiltrate data, corrupt code, or waste resources within the sandbox. It needs to be combined with permission scoping, secrets isolation, and human review.
Why did “excessive agency” rise so much in OWASP’s ranking?
According to OWASP’s GenAI Security Project, it’s a direct consequence of AI systems increasingly being able to browse the web, call tools, and access business systems autonomously — capabilities that barely existed at the scale seen in earlier editions of the list.
Does this apply to tools like GitHub Copilot’s simpler autocomplete mode, not just full agents?
The risk is much lower for autocomplete-style suggestions that a developer reviews before accepting, because there’s no autonomous tool use or multi-step execution involved. The checklist in this article is specifically about agentic modes that can read, write, execute, and act without a human approving each step.
Where can I read OWASP’s full guidance?
OWASP publishes the Top 10 for LLM Applications and a separate Agentic AI Threats and Mitigations guide through its GenAI Security Project at genai.owasp.org, both linked in the Sources section below.
Sources
- OWASP GenAI Security Project — Top 10 for LLM Applications
- OWASP — Agentic AI Threats and Mitigations (Agentic Security Initiative)
- SD Times — Prompt Injection Tops 2026 OWASP GenAI/LLM Top Ten Vulnerabilities
Discover more from Software Online Review
Subscribe to get the latest posts sent to your email.
