19 days of AI coding agent activity, recorded
GIRD's Argus ran in observation mode on one company's engineering laptops. It recorded, and it blocked nothing. Anonymised on purpose: the organisation, its people, its machines and the size of the fleet are not disclosed.
Four named keys left the fleet inside the requests the agents make anyway: two GitHub access keys and two Shopify store keys. Three went to api.anthropic.com inside the agents' own requests. The fourth was written into a Terraform state file and uploaded to S3. A separate token went to Anthropic 216 times, and its type could not be established.
Four questions most teams can't answer
| Question | What is missing when it can't be answered |
|---|---|
| Which AI agents are running? | No inventory |
| What can they access? | No policy |
| What actions did they take? | No record |
| Can those actions be proved to an auditor? | No evidence |
The same fleet, two consecutive weeks
Argus recorded which agents ran, which files they opened, what left the machines and where it went. Every number below is counted from that record.
| What Argus saw | First week | Second week |
|---|---|---|
| Times someone ran a coding agent | 385 | 306 |
| Coding agents on the laptops, and how many were used | 14 installed, 5 used | 14 installed, 6 used |
| Keys we could name that left the laptops | 3 | 3 |
| Outgoing requests that carried a key, token or password | 60 requests, 15 values | 224 requests, 5 values |
| The single token we could not identify, and how often it went out | 35 sends | 216 sends |
| Password and key files opened by the agents' own processes | 19 opens, 6 files | 29 opens, 6 files |
| Connectors (MCP servers) wired into the agents | 20 entries, 9 services | 22 entries, 9 services |
| Agent actions that matched a rule Argus ships with | 914 | 4,028 |
| Agent actions recorded: files, connections, programs, alerts | 12.7M | 20.1M |
Three notes on the counting. A session is one run of an agent by a person; the background check an agent app makes every few minutes is left out. A key is called named when it starts with a code the vendor publishes, so we can say which service it opens. The rules Argus ships with cover opening a password or key file, running a program from a temporary folder, and a secret inside an outgoing request; nobody at the company set them up, and in observation mode they only record.
Three of those lines, in full
A GitHub access key was written into a Terraform state file and uploaded to S3. The same key had gone to AWS Amplify minutes earlier, inside the request that connected the app to its repository. Anyone able to read that file could read the key, and every later apply writes it back.
Why it is hard to see
The upload is an ordinary request from a developer laptop to an S3 bucket the team uses every day. Nothing in it looks like an incident.
One token went to api.anthropic.com 216 times inside 16 hours. Its shape matches a Supabase service-role key, which reads and changes any row in that database if it is one. Its type could not be established, and it left before anyone had identified it.
Why it is hard to see
It travelled inside the same requests the agents make all day, to the AI vendor the team had approved.
Eight of the fourteen installed coding agents recorded no session at all. They remain installed. In the Nx supply-chain attack, that is what malware used: it found coding agents already on developer machines and started them with their permission checks disabled.
Why it is hard to see
An unused agent produces no activity to review, so it appears in no report that counts what agents did.
The same year, in public
Coding agents have leaked keys, wiped databases and been turned against the machines they run on.
| Incident | What happened | Source |
|---|---|---|
| Nx "s1ngularity" Aug 2025 | Trojanised npm packages found Claude Code, Gemini CLI and Amazon Q already installed, started them with permission checks disabled, and had them hunt for secrets. GitGuardian counted 2,349 secrets leaked from 1,079 developer systems. | wiz.io, gitguardian.com |
| Grok Build CLI Jul 2026 | A wire-level capture found the vendor's own tool uploading entire Git repositories, including committed .env files with API keys and database passwords. About 5 GiB left the machine for a task that needed 192 KB, and the in-product privacy setting did not stop it. | thehackernews.com |
| A week of sandbox escapes Jul 2026 | Researchers reproduced sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity. In most cases the agent wrote a file that something trusted outside the sandbox later ran. | pillar.security |
| Production database wiped Jul 2026 | A developer connected a coding agent directly to a hosted database with broad access. Within about ten minutes a migration ran against production and dropped every table. | cybersecuritynews.com |
The full dossier, with a source for every entry: 38 coding-agent incidents.
Two weeks of observation on your fleet, then you decide what to block
Argus installs through your MDM and runs in observation mode. Each week you get the same report this page is drawn from: which agents ran, which credential files they opened, what left your machines and where it went, and which laptops were not fully covered. Blocking is a separate decision you make afterwards, one rule at a time, once you have seen the record.
Book a risk review