Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do I Let a Coding Agent Use a Test Database That Contains Real Customer Data?

Do not; seed a synthetic database or put the real one behind a view that returns placeholders, because every coding agent reviewed reads query results as plain text and none of the vendor pages reviewed describes masking them. Run one SELECT as the agent's role before the first task, and treat anything it returns as sent to the model.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A test database copied from production is the most common kind there is, and it is the one a coding agent should not be pointed at. The reason is mechanical rather than a matter of policy. A coding agent runs a query the way a developer does, through a shell command, a driver or a tool call, and whatever rows come back land in its context as text. The vendor pages reviewed for Cursor, Claude Code and Codex describe approvals, deny rules and sandboxes, and none of them describes a control that inspects or masks a result set. So the answer to the title question is to change the data rather than the agent: a synthetic seed, a masked copy, or a view that returns placeholders. This page works from one record scenario, a SELECT against a customers table that returns real Social Security numbers, and follows it from the rows that reach the agent to the data option that holds up, the other paths that carry rows out of a sandbox, and the checks to run before the first task. How Do You Pilot an AI Agent on Real Customer Data Without Creating a Breach? takes the wider question of pilots on real data.

Key findings

  • Cursor's agent security documentation states that terminal commands and MCP connections need approval by default, which gates the command that runs a query and says nothing about the rows the query returns (Cursor, 2026).
  • Claude Code's permissions documentation describes Read deny rules that block the file tools from a named path and states that they do not apply to a command that reads files without naming them, so a result set, which has no path, is outside what a deny rule governs (Anthropic, 2026).
  • Codex documentation states that the agent runs with network access turned off by default and asks for approval to run commands that require it, which controls whether a remote database is reachable and not what a permitted query returns (OpenAI, 2026).
  • Sonatype reported that 56% of the malware it discovered in Q1 2025 was related to data exfiltration, up from 26% in Q4 2024, the kind of code a dependency install can bring into a sandbox holding real rows (Sonatype, 2025).
  • A governed environment replaces values chosen by policy with consistent tokens before any model reads the screen, so an agent working a customer record on a rendered page sees CUST_001 and not the Social Security number (What Is Render-Layer Tokenization?).
  • Real values resolve only at the approved destination at the moment of an approved action, so the model finishes its work without having held the value it was protecting (What Is the PII Wall?).

What reaches the agent when it queries the test database?

Everything the query returns, as text. Suppose the task is to fix a duplicate-detection routine, and the agent runs SELECT id, name, ssn FROM customers LIMIT 20 to see what the data looks like. The twenty rows come back through the shell or the driver and are placed in the agent's context, where they are read by the model exactly as a stack trace or a file would be. From there they can be quoted in the agent's reasoning, pasted into a test fixture, written into a commit message or sent with the next request. The rows have no special status. A Social Security number in a result set is a string like any other.

The scope of the controls on this page needs stating plainly. A governed browser environment covers what an agent reads and does on a rendered page: a database console, an admin dashboard, a settings page, a sign-up form. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, and nothing on this page should be read as a browser control governing a shell. A query run from a shell is on the far side of that line, which is why the data itself has to change.

The research record shows that values which reach a model can come back out. Huang, Li, Wu and colleagues found that neural code completion tools "can not only return the precise piece of their training data," and that "two valid credentials were identified during our experiments" (Huang et al., 2024). That study concerns training data rather than a session's context, and the abstract does not give the number of tools or credentials tested, but the direction is the one that matters here: a value a model has been shown is a value it can reproduce. For a result set of real customer rows, the safe assumption is that whatever came back was sent.

What do the vendors themselves say?

Cursor's agent security page states that "by default, terminal commands need your approval" and "all MCP connections need your approval" (Cursor, 2026). Those approvals gate the command that runs a query; the page does not say how credentials are stored or protected, and says nothing about the rows that come back.

Anthropic's Claude Code permissions page states: "To block Claude's file tools from reading a file or directory, add a Read deny rule for its path, such as Read(./.env) or Read(./secrets/**)." It adds that the rules "don't apply to a command that reads files without naming them," and points to the sandbox "for OS-level enforcement that blocks all processes from accessing a path" (Anthropic, 2026). A deny rule names a path, and a result set has none, so this control does not reach it.

OpenAI's Codex documentation states that "locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace)" and that "by default, the agent runs with network access turned off" (OpenAI, 2026). The network default decides whether a remote test database is reachable; once a command is approved, the database decides what comes back. A control that masks or filters the rows a query returns is not described in the pages reviewed for any of the three vendors.

Dimension Cursor Claude Code Codex What a buyer should verify
Gate on the query command Terminal commands need approval Read deny rules; sandbox for OS-level paths Network off by default; approval to turn it on Who approves the connection string
Gate on the result set Not addressed Deny rules name paths, not output Sandbox limits what is touched, not returned What one SELECT returns in a dry run
Record of what the model read Not addressed Not addressed Not addressed Whether rows reach transcripts

Synthetic data, a masked copy, or a view: which one holds up?

All three keep real values out of the result set, and they fail in different places. A synthetic seed is the cleanest: the customers table holds generated names and generated nine-digit numbers, and a SELECT returns nothing anyone owns. Its weakness is coverage. Bugs that depend on the shape of real data, such as a surname with an apostrophe, may not appear in generated rows, and the generator has to keep pace with the schema.

A masked copy replaces the sensitive columns of a production snapshot in place, so the edge cases survive while the identifiers do not. Its weakness is completeness. A notes column, a JSON blob or a log table that carries an identifier the masking job did not know about leaks the value the structured columns protected, and a refresh from production has to re-run the job before the agent connects.

A placeholder view leaves the real table in place and grants the agent's database role access only to a view that substitutes SSN_001 for the real number, consistently across rows. Its weakness is privilege. If the agent's role can also read the underlying table, the placeholder layer is one query away from being bypassed, so the role has to be restricted at the database, which is what the GDPR's data minimisation principle, Article 5(1)(c), asks for when it limits personal data to what is necessary for the purpose (How Do You Pilot an AI Agent on Real Customer Data Without Creating a Breach?). Platform governance helps where traffic is routed through it: Databricks describes Unity Gateway as governing traffic between models, agents, MCP servers and tools once that traffic is routed through the platform, which leaves a direct driver connection from a sandbox outside it (RedactSure vs Databricks: 2026 Comparison & Alternative).

What else can carry rows out of the sandbox?

Three routes deserve a look once the agent holds real rows, because each is documented and none depends on the model's judgment. The first is the network. The Firecracker design document, which describes the microVM many agent sandboxes run in, states that "all egress traffic from a guest is therefore considered untrusted, and should be filtered at the host-level" (Firecracker, 2026). A sandbox that can reach the test database can usually reach other hosts, so the egress filter decides where a pasted result set can travel.

The second is the dependency install. Datadog reported that "throughout 2024, Datadog identified thousands of malicious PyPI and npm libraries in the wild" (Datadog, 2025), and Sonatype found that 56% of the malware it discovered in Q1 2025 was related to data exfiltration (Sonatype, 2025). An agent that installs a package into a sandbox holding real rows has placed exfiltration code next to the thing worth taking.

The third is the tool connection. The Model Context Protocol's security guidance warns "that MCP servers run with the same privileges as the client" and notes that "cloud metadata endpoints often expose IAM credentials, API keys, and other secrets" (Model Context Protocol, 2026). A database MCP server with the agent's privileges returns rows with the agent's privileges. Push protection closes a fourth, narrower route: GitHub states that it "acts as a frontline defense mechanism by scanning code for hardcoded secrets at the time of the push" (GitHub, 2026), which catches a connection string in a fixture and not a list of real names.

What should the team check before the first task runs?

Run the query the agent is going to run, as the agent's role, and read the output. One SELECT against the customers table, through the driver or shell the agent will use, shows whether the ssn column comes back as a nine-digit number, a placeholder or an error. Repeat it for every table the task touches, including notes and log tables where identifiers hide in free text.

Then check the role. List the grants on the agent's database user and confirm it cannot read the base table, create views or read other schemas. Is It Safe to Let an AI Agent Set Up Your Cloud Environment? makes the point about root access keys, which AWS strongly recommends not creating. Microsoft's Copilot Studio documentation draws the same line with user authentication where data access must be restricted to specific groups or individuals (What Can Microsoft Copilot Studio Agents See?). The connection string needs the same care, as How Do You Let an AI Agent Manage API Keys Without Reading Them? shows: GitGuardian's data, as reported by Help Net Security, counted 28,649,024 new credentials exposed in public GitHub commits across 2025.

Do not count on a guardrail. The LlamaFirewall preprint describes PromptGuard 2 as "a universal jailbreak detector" and reports "stronger efficacy at preventing indirect injections in general scenarios than previously proposed approaches" (Chennabasappa et al., 2025). That is a control on instructions, not on which values a result set carries. Cursor's documentation says the AI "can behave unexpectedly due to prompt injection, hallucinations, and other issues" (Cursor, 2026); the defense against that is rows that were never real.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a customer record shows CUST_001 and SSN_001 on every page the agent opens, and the model works on the placeholders. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, such as a record change or a submission. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this question it covers the pages, not the query. When the agent opens a database console, a data browser or an admin dashboard in the browser to look at the customers table, the Social Security numbers on that page are replaced before the model reads them, and the record shows what the model saw. The query the agent runs from a shell is outside that scope, which is why the first half of this page is about the data: a synthetic seed, a masked copy or a placeholder view is the control for the shell route, and the governed environment is the control for the rendered route. Applying both closes two routes to the same rows.

Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so a driver connection from the sandbox is not closed by it. That route is closed by what the database returns to the agent's role, which the check in the previous section confirms.

Methodology and limitations

This page rests on vendor documentation from Cursor, Anthropic and OpenAI, the Firecracker design document, the Model Context Protocol security guidance, GitHub's push protection documentation, two research papers, two vendor research reports from Datadog and Sonatype, and existing RedactSure research pages. The vendor and standards pages were read as of October 20, 2026. Quoted facts are cited to the page that states them, and figures from vendor research are cited as reported by those vendors, not as independently measured. The page is a reading of public documents and should be read with each vendor's current documentation open.

RedactSure did not test Cursor, Claude Code or Codex hands-on against a database. "Not described in the pages reviewed" means the pages reviewed and nothing broader; Copilot and Devin are not covered because no page for either was read. The table is a summary of the documentation as read and not a configuration guide. The research papers concern memorization and guardrails in general and are cited for the principle only. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. Examples describe record types, such as a SELECT returning Social Security numbers, and not organizations.

Determinations about whether a test database meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces running the agent's own query as the agent's own role against the organization's own test database, repeated after each schema change and each refresh from production, since either can reintroduce a real value. A later release of any agent should be treated as unreviewed until the check is repeated.

What the record shows

The documentation answers by omission. Cursor gates terminal commands and MCP connections with approvals, Claude Code's deny rules govern named paths and point to the sandbox for OS-level enforcement, and Codex turns network access off by default and asks before a command that needs it. Each of those controls decides whether a query runs. None decides what it returns, and none describes masking a result set, so a test database holding real customer data delivers those rows to the model whenever a query is allowed. The research record adds that values a model is shown can be reproduced, and the supply chain record adds that exfiltration code is common in packages. The data has to change: a synthetic seed, a masked copy or a placeholder view, with the agent's role unable to read past it. Running the agent's first query as the agent's role and reading what comes back is the test that settles whether the change worked.

Frequently asked questions

Can I let a coding agent use a test database that contains real customer data?

Not as it stands. A coding agent reads query results as text, and the vendor pages reviewed for Cursor, Claude Code and Codex describe approvals, deny rules and sandboxes without any control that masks a result set. Replace the real values first with a synthetic seed, a masked copy or a view that returns placeholders, restrict the agent's database role so it cannot read past that layer, and run the agent's first query yourself to confirm the ssn column comes back as a placeholder.

Is a database view that returns placeholders enough?

It is enough when the agent's role can reach only the view. The view substitutes a consistent placeholder for each identifier, so joins and duplicate checks still work on SSN_001 and SSN_002. It stops being enough if the role can also read the base table, create a new view or query a schema the view does not cover, because one query then bypasses it. Grant the role on the view alone and confirm the grants by listing them, not by trusting the migration that set them.

Does Claude Code's Read deny rule protect the database?

No. The permissions documentation describes Read deny rules as blocking the file tools from a named path, and states that they do not apply to a command that reads files without naming them. A result set returned by a driver has no path to deny. The rule is useful for the file that holds the connection string, and the sandbox is the documented route for OS-level path enforcement, but neither inspects rows. Protect the rows at the database, where a role and a view decide what any query returns.

Does Codex running with network off solve this?

It decides whether a remote database is reachable, and nothing more. Codex documentation states that network access is off by default and that the agent asks for approval to run commands that require it, so the first connection to a remote test database is a visible event. Once that approval is given, the database decides what comes back. A local database file inside the workspace needs no network at all, so the default does not apply to it, and the data still has to be synthetic or masked.

What if the bug only reproduces on real data?

Reproduce it on a masked copy that keeps the shape of the real rows. Most data-dependent bugs turn on structure, such as duplicate records with trailing spaces, a surname with an apostrophe or a null in a column the code assumed was populated, and a masking job that preserves length, character class and nulls keeps those while replacing the identifiers. If a case survives only with the real value, a developer reproduces it by hand outside the agent's session and hands the agent a fixture with the value replaced.

Which governed environment covers a coding agent's database work?

One that substitutes tokens at the render layer covers what the agent reads on a rendered page, such as a database console, a data browser or an admin dashboard, and keeps a record of what the model saw there. It does not govern a query the agent runs from a shell, a driver or an MCP server, so the data behind that query still has to be synthetic, masked or behind a placeholder view. One control for the page and one for the query close both routes.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Customer Row Out of the Agent's Context

A query returns rows as text the agent reads like a stack trace, and the controls reviewed gate commands, paths or networks without inspecting the console.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent opens the customers table in a console, twenty Social Security numbers enter its context, and any can land in a fixture. Inside the governed environment: the console renders CUST_001 and SSN_001 on every page, the agent fixes the routine on placeholders, and real values resolve only in the record change a named person approves. The shell SELECT stays with the seed or view.

RedactSure is deploying now with enterprise and government customers. Sonatype linked 56 percent of the malware it found in Q1 2025 to data exfiltration.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A test database with real customer rows turns every debugging session into a data access event. Bring a database task and see, with test values, what the model reads in the console. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.