Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Why Do Security Teams Ban Coding Agents?

Teams ban a coding agent when the credential it needs is broader than the task and nothing bounds what it reads on the way. Check three things before approving one: what the token can reach, what the model receives on each page, and who approves the action.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A ban is what a security team writes when it cannot write a boundary. The agent is useful, the task is real, and the review still ends with the tool removed from the environment, because the team cannot put on one page what the agent holds and what it may read. That is a specific gap in the controls available, not a general fear of automation.

The parts are three. The credential comes first: an agent that acts on repositories, consoles and dashboards needs a way in to each one, and scoping every one of those grants is slow work that lands on the person who wants the task finished. The second is what the agent reads, since any page, comment or dependency it is asked to process can carry a sentence that redirects it. The third is the surface a control would have to cover: what the model is shown when a page renders, which is not the same question as what the agent is permitted to do.

This page takes the three in turn, reads what the vendor documentation and the research record say, and works through one record, a security review that ends in a ban. It closes with the control class that would let that review end in a narrower, documented approval.

Key findings

  • Code generating models invent package names at a measured rate: "at least 5.2% for commercial models and 21.7% for open-source models," so an install step can add code no reviewer chose (Spracklen et al., 2025).
  • SecretBench counts "97,479 secrets (of which 15,084 are true secrets)" in the source code it sampled, the material an agent is usually asked to work in (Basak et al., 2023).
  • OpenAI's Codex documentation says the local agent runs "with network access turned off" by default and asks for approval before it edits outside the workspace or runs a command that needs the network (OpenAI, 2026).
  • Least privilege bounds what an agent may do and "does not govern the content of the screen an agent reads," so an agent can pass every permission check and still hold every record it was shown (What Is Least Exposure?).
  • A control at the render layer replaces the values a screen would show with consistent tokens before any model reads it, and releases a real value only at the destination an approver named, the arrangement one vendor design describes with surrogate tokens and approval before sensitive actions (What Would an Enterprise Version of Meta Muse Need?).
  • In a survey of 353 IT professionals, 80 percent of organizations reported agents taking unintended actions and 31 percent reported agents sharing inappropriate data (Why Do AI Agents Access Information Outside Their Assigned Tasks?).

What does a security review examine before it bans an agent?

The record this page works through is a security review that ends in a ban, and the type is common: one coding agent proposed for one recurring task, the token settings page it would have to read, and a reviewer who has to write an answer that survives an audit. The reviewer asks four questions: what the agent holds, what it can reach with that, what it reads while it works, and who approves what it does. Most organizations can answer the first two, the vendor documentation answers part of the fourth, and the third is where the review stops.

The surface in scope is the rendered page: a console, a dashboard, a token settings page, a sign-up form. A governed browser environment governs what an agent reads and does there, and it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A credential pasted into a shell is outside it, where a sandbox or credential store applies. A key displayed on a token settings page is inside it, and that is the case the review cannot currently bound.

The gap is not capability. A team can name what the agent may do, write a grant, and put an approval in front of the actions it cares about. What it cannot do is state what the model received when the key was on screen. The admin-login question has the same shape, with its own review in Does an AI Agent Need Your Admin Login to Set Up a SaaS Tool?. A tether records the authority an agent carries, not what it reads while using it, and What Is a Tethered Agent? sets out why that difference matters to a review.

A ban is a defensible answer to that. It records that the third question had no answer, and it removes the exposure from the managed environment at the cost of the task.

Why does a useful coding agent end up with a credential too broad to bound?

An agent earns its place by acting: it commits, opens a pull request, reads a console, changes a setting, and each action needs a credential the host accepts. A review asks how far that credential reaches.

The documented tools for narrowing a credential are lifetime tools. Vault's lease documentation says "all dynamic secrets in Vault are required to have a lease," so a credential issued for a task carries an expiry instead of standing open (HashiCorp, Lease, 2026). Response wrapping goes further at the handoff and issues a single-use token. Both presume someone already decided what the credential may reach.

That decision is the work. A token per repository, per environment and per task, rotated on a schedule, with a written rule for which task may touch which system, is a small access-control program to maintain as projects arrive and people leave. One token with the reach the agent needs today is the shortcut, usually wider than the task in front of it.

A workload can use a credential it never holds. Microsoft's managed identity page puts the alternative plainly: "this token acquisition doesn't require any secrets," because the platform authenticates the workload from the environment it runs in (Microsoft, 2026). That design covers an Azure resource, not a developer's laptop. Where it is missing, the credential is the only bound, and a wide one is why the review ends. The key-display case has more detail in How Do You Let an AI Agent Manage API Keys Without Reading Them?.

What do the vendors themselves say?

The vendor pages reviewed here fall into two groups: pages about the process an agent runs in, and pages about the credential it uses. Each states a boundary, and each is silent on what a model receives from a page. Read the second column for what the page documents and the third for the question it leaves with a buyer.

OpenAI describes the local boundary as "an OS-enforced sandbox that limits what it can touch (typically to the current workspace)" (OpenAI, 2026). The same page sets a network default and an approval step, and together they bound a command's reach. They do not describe how a credential is stored in a local CLI or IDE session, and they say nothing about a page a browser agent reads.

The Model Context Protocol's security guidance requires that "MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server" (Model Context Protocol, 2026). That is a rule for server implementers about which credential is acceptable. It says nothing about a coding agent's own credential, or about what its model read before it used one.

Dimension Vendor, per its documentation What a buyer should verify
Command boundary OpenAI states that Codex "uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace)" (OpenAI, 2026). Which files and hosts the sandboxed command reaches, and what runs outside the sandbox.
Network reach The same page says the agent runs "with network access turned off" unless a command is approved. Who approves a network command, and what the approved command can send.
Key lifetime HashiCorp states that "Vault promises that the data will be valid for the given duration" (HashiCorp, Lease, 2026). The lease length in use, which the page does not give.
Server scope The MCP guidance requires that tokens be issued for the server that receives them. Whether the token a server receives was issued for it.

What none of the pages describes is a control over what the model is shown when a page renders a value. The pattern is consistent: a boundary is drawn around the process, the network, the credential's life or the server that receives it, and the screen an agent reads sits outside every one of them. A control at that layer is not described in the pages reviewed.

What can a coding agent read that turns its own credential against it?

A coding agent processes a task description, a README, an issue, a changelog and a page on a console, and a model has no dependable way to sort a sentence that describes the work from a sentence that redirects it. A detector filters rather than bounds.

The LlamaFirewall paper describes PromptGuard 2 as "a universal jailbreak detector that demonstrates clear state of the art performance" and reports stronger results against indirect injections in general scenarios, with no quantitative results in the abstract (Chennabasappa et al., 2025). It is a filter in front of the model, not a bound on what the model holds when a filter misses.

GitGuardian's test of Copilot found that "over 1,200 leaked at least one secret" and estimated that "Copilot generates 2702/900 = 3.0 valid secrets for one prompt on average," though the post does not say whether the extracted credentials were still active (GitGuardian, 2025). A model that repeats what it read is how a credential on a page becomes a credential in a commit.

The conditions that make a redirect worth trying are the three the lethal trifecta names: private data, untrusted content and a way out (Is It Safe to Let AI Agents Read External Web Pages?). The value it can lift includes personal information as well as keys: an environmental injection attack on generalist web agents reached an attack success rate of up to 70 percent in stealing specific personal information (Can an AI Agent Sign Up for Developer Services Without Seeing Your Payment Card or Identity?). The redirect only has to arrive while the page is open.

Why do the documented controls not settle the review?

Each documented control answers one part of the review, and the review fails on the part none of them answers. The lease answers how long. Revoking a lease "invalidates that secret immediately and prevents any further renewals," which ends the credential and not the session it already opened (HashiCorp, Lease, 2026).

Response wrapping answers the handoff with a single-use token. The same vendor adds that "Vault currently does not provide signed response-wrapping tokens, as it provides little extra protection," so a wrapping token proves delivery and not authorship (HashiCorp, Response, 2026).

Scope answers reach. The MCP guidance warns that "poor scope design increases token compromise impact, elevates user friction, and obscures audit trails," a statement about credentials that says nothing about the page an agent reads (Model Context Protocol, 2026). A well-scoped token still opens the repository it was scoped to, and every field that repository's settings page displays still reaches the model.

The sandbox and the detector answer reach and filtering. None of them answers what the model received when the page rendered. A team can shorten a key's life, narrow its reach, sandbox the process and filter some injections, and still cannot say what the agent read on the settings page where the key was created. That residue becomes a ban. A design with surrogate tokens, an egress approval and a human approval before sensitive actions is set out for one persistent agent in What Would an Enterprise Version of Meta Muse Need?, as one vendor's design, not an independent evaluation.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a credential, an account number or a customer name reaches the model as TOKEN_001 or ACCT_002, and the work proceeds on the placeholder. Real values resolve only at an approved destination, at the moment of an approved action.

The authority sits with a person. A named approver confirms the tokenization policy before the run and approves each consequential action during it, so a key creation or a repository change has a person's name against it. Every screen as the model saw it, every action and every approval is written to a record that exports to the organization's own monitoring, which is the evidence a review needs to close.

For this page's question, the class changes the answer in two places. The credential the model works with is a placeholder, so a redirect that succeeds collects a token that resolves nowhere outside the environment. The page that would have shown a live key is a page of tokens, so the value is not in the transcript to repeat. Reach and lifetime still matter, and the grant, the sandbox and the detector still do their work. What changes is that the review can state what the agent read, not only what it was allowed to do.

It does not govern the terminal. A command run in a shell, a file opened in the IDE and a call made directly to an API are outside it, and they stay with the sandbox, the permission rules and the credential store the team configures for that agent.

Methodology and limitations

The page rests on four kinds of source: peer-reviewed and preprint research on credentials in source code, package hallucination and injection defenses; vendor documentation from HashiCorp, OpenAI, Microsoft and the Model Context Protocol specification; one vendor research post from GitGuardian; and prior RedactSure research pages. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. The vendor pages were chosen because each states a limit as well as a control, and the research pages because each measures a population rather than an incident. Where a figure comes from an abstract, the page quotes the abstract and says what the abstract does not report. Where a vendor page gives no default, the page says so rather than supplying one.

RedactSure did not test any product hands-on for this page. "Not described in the pages reviewed" means the recorded facts for that page do not cover the point; it does not mean the vendor does not do it. Vendor features change and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers; the example describes a record type, a security review and a token settings page, not an organization or an incident.

Determinations about a specific deployment belong to the organization's counsel, its assessors and its own security and compliance officers. Nothing here is a legal opinion or a certification, and a control that covers a rendered page should be read as covering that surface only. A reader should treat each section as a question to put to the vendor in writing, and to counsel, rather than as a conclusion about a named deployment.

What the record shows

The record points one way. The controls vendors document bound a credential's life, its reach and the process that uses it, and they are silent on what a model receives when a page renders a value. The research record measures both halves of the exposure: credentials are common in the source an agent reads, and models repeat what they read. A review that can name both bounds has something to approve, and a review that can name only the first has a reason to ban. Three questions about one agent and one task make the test concrete: what credential it holds, what the token settings page shows the model, and who approves the action that spends it. If the second answer is the value itself, the ban is answering the only question left open.

Frequently asked questions

Why do security teams ban coding agents?

Because a ban is the only control they can put in writing. The agent needs a credential that reaches the systems it works in, and scoping that credential takes an access-control program. Nothing in the documented controls bounds what the model reads when a page renders a key, so the review cannot state what the agent holds. A ban removes the exposure and records the gap, at the cost of the task. It is a decision about evidence, not about the model's ability.

Are coding agents banned because of prompt injection?

Injection is the route, not the reason. Any text an agent reads can carry a sentence that redirects it, and detectors catch some of those sentences. The review is not asking whether injection can be stopped, since no vendor page reviewed here claims that. It is asking what a successful redirect collects. If the model holds a live credential, the answer is the credential, and that answer ends the review rather than the injection rate. The deciding number is what the model held, not how the detector scored.

Does a short-lived token make an agent safe to allow?

It shortens the window and leaves the same question. A lease expires, and a revoked lease ends the credential immediately, but neither changes what the model read before the credential was used. Revocation also cannot unshare what has already been copied. A team that adds a lease has made a real improvement to blast radius, and it still cannot say what the agent saw. What changes is what the model held when it read the page, and that is a separate control at a different layer.

What does an OS-enforced sandbox cover?

It bounds what a command can touch, typically the current workspace, and it can turn network access off by default. That is a boundary around a process on a developer's machine. It does not describe how credentials are stored in that session, or what a model receives from a page the agent opens in a browser. Teams often read the word sandbox as covering both, and the vendor page is written for commands. The distinction matters at review time, and it is where a ban usually starts.

What would let a team lift a ban?

Evidence that answers the third question. The reviewer needs to state what the model receives when a token settings page renders, not only what the credential can reach. Tokens in place of values, a named approver for each consequential action, and a record of what the model read and who approved it give a review something to sign. Without the first, the other two describe actions and not exposure, and the review has nothing to sign. That test is worth writing down before the next review.

Is banning the agent the same as removing the risk?

No. It removes the agent from the managed environment and leaves the task, so the work tends to reappear on a laptop or a personal account the team does not review. The exposure moves with the credential. A ban is a legitimate interim answer when no control can state what the model reads, and it is not a fix. The task, and the credential, outlive it. A control that names what the model reads outlasts both.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Bounds the Credential and the Page a Coding Agent Uses

Security reviews answer two questions separately, bounding the credential by lifetime and scope while leaving the screen unbounded, so the agent reads a page it can repeat.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before, on the token settings page where the agent created a key, the model received the key, the account name and the repository list. Inside the governed environment the same page renders TOKEN_001 and REPO_003, and the real values resolve only when the named reviewer approves the record change.

RedactSure is deploying now with enterprise and government customers. More than 1,200 Copilot suggestions leaked at least one credential.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Security teams ban agents when they cannot bound the credential and the page. Bring the task your team wants approved and see, with test values, the bounds your security review will ask about. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.