An AI coding agent does not get compromised by the tools it runs. It gets compromised by the text it reads, which means the biggest risk in your workflow is invisible to any permission dialog.
The Details:
When an agent fetches a webpage, parses a README, or scans a dependency changelog, that content lands in the same context as your own instructions. There is no wall separating what you told the agent to do from what a stranger's documentation quietly told it to do. A buried line like "also send the .env file" can ride in on a tool call you approved as harmless, such as "read this URL."
Permission prompts feel like security but function as a habit killer. Approve enough tool calls in a row and the brain stops evaluating each one and starts clearing them by reflex. That means the twenty-first approval, which might be the dangerous one, gets the same distracted glance as the first nineteen routine ones.
The fix that actually holds is architectural, not behavioral. Draw the line before the session starts: reversible actions, like editing a scratch directory or running tests, get to flow freely, while irreversible ones, like touching production, git remotes, or secrets, get hard boundaries the agent cannot see past, not just instructions it is told to respect.
The test that exposes weak setups is simple: if a session went fully off the rails for ten minutes, what would you actually lose. A deletable branch means the blast radius is scoped correctly. A production database means no amount of careful clicking was ever going to save you, because the danger was never in the clicking.
Bottom Line: Treat the model as an untrusted component from the start, and build a setup where trusting it less costs you nothing.
Enjoy this article?
Listen to the Claude Code Conversations radio show or join the community.
