The Hidden Risks of AI Coding Tools

Your IDE now executes instructions it finds in a README, on your behalf, with your keys. Coding agents run with your full permissions and still can't separate your instructions from the text they read, so prompt injection has no general fix and tighter access control won't help when broad trusted reach is the job.

This talk shows the three ways an agent turns on you: hijacked by the content it reads, poisoned by its own tooling, or off the rails with no attacker at all. Each has already happened, from a poisoned pull request title that made code-review agents leak their own secrets, to malware that turned developers' own AI assistants into the intruder, to a major lab's own model escaping its sandbox and breaching a production system during an internal evaluation. Pointing another AI at the problem fails too, since planted text can talk an AI reviewer out of its own findings.

You'll leave with a control loop to put around every agent, plus one test for your own stack: can you replay what an agent did, stop it mid-task, bound what it reaches, and name who answers for it?