Secure Your Coding Agent Like It’s Malware

Coding agents are dangerous: they can write files (including their own permissions or scripts meant to keep them in check), scan the filesystem, read credentials, and make tool calls that modify databases or exfiltrate data. Any content the agent processes (a pull request, an external code library, or online documentation) can trigger these actions and lead to persisted compromise. The 'Comment and Control' attack demonstrated this, as did the mini-Shai-Hulud attack, which copied its loader into Claude's settings.json, so it re-executed on every session start.

Built-in agent sandboxes are inadequate. Agents are very good at escaping them (see SandboxEscapeBench) but often need not, as they can disable the sandbox themselves, as specified in the Claude bash sandbox documentation.

Can we make coding agents secure? This talk is for developers running coding agents on their machines or in CI/CD. First we map the attack surface: prompt injection variations (e.g. role-play, poem attack) and how to hide them (Unicode smuggling, custom glyphs). Then we cover seven specific threats (supply chain compromise, data exfiltration) and seven defence layers.

We treat the agent itself as untrusted, clamping it down with externally enforced controls it cannot reach or reconfigure (VMs, network firewalls). Attendees will leave with a sandbox taxonomy to evaluate their own setups, a set of ready-to-use tools that score well against it, and a concrete plan to shrink their agents' blast radius.