Security, secrets and data leakage

• Secret — a credential: API key, token, password, private key or connection string.
• Prompt injection — untrusted content (a web page, issue, file, log) containing instructions that try to hijack the model.
• Exfiltration — sending data out of a trusted boundary, e.g. an agent posting a secret to an attacker’s URL.
• Sandbox — an isolated environment limiting what a process can read, write and reach.
• Least privilege — granting only the access a task needs.
• SAST / SCA — static analysis of your code (SAST) and of your third-party dependencies (SCA).
• Zero data retention (ZDR) — a provider arrangement where prompts and outputs are not stored or used for training.

• Pasting .env contents, logs or stack traces containing tokens into a prompt.
• An agent reading secret files (.env, cloud credentials, SSH keys) because they sit in the working directory, putting them into the provider’s context.
• Generated code hardcoding a key that then gets committed.
• Tool output (shell, MCP) returning secrets into the transcript.
• Prompts and transcripts stored by the provider or synced to logs.

Once a secret has entered a prompt or a commit, treat it as compromised and rotate it.

• Deny the agent read access to secret files and directories through its permission rules or ignore files.
• Load secrets from a secret manager or environment at runtime, not from files in the repo.
• Use short-lived, narrowly scoped credentials for anything the agent can touch (a dev token, never production).
• Run secret scanning (pre-commit and CI) so a hardcoded key is caught before it merges.

An agent that reads issues, READMEs, web pages, dependency code or tool output can be steered by instructions hidden there. The danger is the combination of untrusted input, access to private data, and an outbound channel; remove any one leg and the attack weakens. Treat all fetched content as data, not instructions.

Run agents with the narrowest permissions that work: allow-lists for commands, no network by default or only to approved hosts, filesystem limited to the project, and human approval for destructive, outward-facing or irreversible actions (push, deploy, delete, send). Run unattended agents inside a container or VM, never on a machine holding production credentials.

Decide which code and data may be sent to which provider. Check retention, training-on-your-data and region terms; enterprise and API tiers usually differ from consumer ones. Regulated data (personal data, health, payments) should not enter prompts at all unless the contract and controls allow it, and production data should be masked or synthetic in dev contexts.

Generated code can resemble licensed open-source code. Use provider features that filter or flag matches where available, keep your normal license-compliance scanning on, and follow your organisation’s policy on AI-authored contributions.

Injection through string-built queries, missing authorization checks, hardcoded secrets, unsafe deserialization, weak or outdated crypto, overly permissive CORS and IAM, and trusting client input. Run SAST, SCA and dependency checks in CI regardless of who wrote the code, and review authentication and authorization paths by hand.

Agents add packages freely, including nonexistent or typosquatted ones. Review every new dependency (existence, maintenance, license, download history), pin versions, use lockfiles, and keep install scripts from running unreviewed.