The question What is the blast radius of one agent?
Why the answer is everything you can reach
A coding agent isn't a separate user. It's a program you start, so it runs with your account's permissions. So do the shell commands it runs and the MCP servers it starts. The MCP docs say a local server “can perform any file operations you can perform manually”.
Opening a project doesn't fence the agent into it. In Manual mode, Claude Code asks before its file tools leave the folder you started it in. Its security docs are plain about the limit. The boundary “is a permission prompt, so a Bash command you approve can still write anywhere your user account can”.
What sits within reach
| What | Where it usually lives | Why it matters |
|---|---|---|
| Source code | Every repository on the disk, not only the open one | Code, history and any secret ever committed |
.env files | Project folders | API keys and database passwords in plain text |
| Shell history | ~/.zsh_history, ~/.bash_history | Tokens typed or pasted into commands |
| Cloud credentials | ~/.aws/credentials and other cloud CLI logins | Access to production accounts |
| SSH keys | ~/.ssh/ | Servers and Git hosts that trust the key |
| Git and package tokens | The GitHub CLI's token, ~/.npmrc | Pushing code and publishing packages |
| MCP tokens | ~/.cursor/mcp.json, ~/.claude.json and other MCP configs | GitHub, database and SaaS access, often in plain text |
| Downloads and exports | Your Downloads folder | Customer lists and reports saved from web apps |
| The network | Any host, unless something blocks it | The way everything above leaves |
Attackers know this list. The Nx malware of August 2025 searched for wallets, keystores, .env files and SSH keys. It also took the GitHub CLI's token and the contents of .npmrc. Tokens in MCP configs are common too: GitGuardian found 24,008 unique secrets in public MCP configuration files, 2,117 of them valid.
The same files come up in ordinary agent use. In GIRD's 19-day case study, agents' own processes opened credential files 19 times across 6 files in week one. In week two it was 29 times across 6 files. The agents were also wired to 20 MCP connector entries across 9 services, rising to 22 entries in week two.
How sandboxes and prompts narrow it
The four agents below each ship approval prompts, a sandbox or both. The defaults differ, and each one has a switch that turns them off.
| Agent | What guards you by default | The off switch |
|---|---|---|
| Claude Code | Prompts, or a background classifier, review risky steps. The sandbox is off by default. | --dangerously-skip-permissions |
| Codex | The default sandbox limits it, typically to the workspace, with network access off. It asks before going further. | --dangerously-bypass-approvals-and-sandbox, or --yolo |
| Gemini CLI | Prompts for approval before running tools. | --yolo |
| Cursor | Auto-review: allowlisted calls run, other shell commands run in the sandbox when possible, and the rest go to a classifier. | Run Everything mode |
The vendors warn about their own off switches. Anthropic says to use its bypass mode only “in isolated environments like containers, VMs, or dev containers without internet access”. It adds that the mode “offers no protection against prompt injection or unintended actions”. OpenAI labels its bypass flag “not recommended”. In Cursor's Run Everything mode, “Every tool call runs automatically.”
A sandbox that is on still needs checking. Claude Code's sandbox docs warn that its default read access “still allows reading credential files”. Add deny rules for paths such as ~/.ssh and ~/.aws.
How the guard rails come off
Prompts cost time. Anthropic's own security page lists “Prompt fatigue mitigation” among its built-in protections. When prompts pile up, the off switch is one flag away.
Attackers use the same switches. The Nx malware ran the installed Claude, Gemini and Amazon Q tools with --dangerously-skip-permissions, --yolo and --trust-all-tools.
A prompt also fails when the person approves without checking. On 26 February 2026, Alexey Grigorev let Claude Code run Terraform for the DataTalks.Club course platform. The agent had swapped in an older state file. It then ran terraform destroy, and he didn't stop it. Production went: the VPC, the RDS database, the ECS cluster, load balancers, a bastion host and every automated snapshot. The platform held 2.5 years of submissions. AWS restored a snapshot 24 hours later. “I over-relied on the AI agent to run Terraform commands,” he wrote.
When reach turns into damage
In April 2026, a Cursor agent working in PocketOS's staging environment hit a credential mismatch. It “went looking for an API token and found one in an unrelated file”, The Register reported. The token was made for managing custom domains but was “scoped for any operation, including destructive ones”. One API call deleted the production database and its volume-level backups. It took nine seconds. Railway helped restore the data within an hour.
In July 2026, a researcher captured the network traffic of xAI's Grok Build CLI, version 0.2.93. It uploaded a snapshot of the whole repository, every tracked file plus Git history, including files the agent never read. On a 12 GB test repository, 5.10 GiB went out, still climbing when the capture stopped. The model calls needed 192 KB. A .env file's contents went too. Turning off the “Improve the model” setting didn't stop the upload. xAI later disabled the upload on its side.
Both cases, and the Terraform one above, are in GIRD's incident dossier of 38 publicly reported coding-agent incidents, each with its source.
Keys leave the same way in ordinary use. The case study found four named keys inside ordinary agent requests: two GitHub access keys and two Shopify store keys. Three went to api.anthropic.com. The fourth was written into a Terraform state file and uploaded to S3, minutes after the same key went to AWS Amplify. Where AI agents leak your keys traces where secrets end up.
How to shrink the blast radius
- Turn the sandbox on, and deny reads of credential paths such as
~/.sshand~/.aws. - Block bypass modes centrally. In Claude Code, set
permissions.disableBypassPermissionsModeto"disable"in managed settings, where users can't override it. - Move long-lived keys out of plain-text files, and scope each token to its job. See Least privilege for AI agents.
- Give each MCP server its own narrow token. See What is MCP, and how do MCP servers create risk?
- Limit where agent traffic can go, and keep a record of what leaves.
FAQs
Does a coding agent only see the folder I open it in?
No. In Manual mode, Claude Code asks before its file tools leave the folder you started it in. Its docs say that boundary is a permission prompt: a shell command you approve can still write anywhere your user account can.
Is a sandbox enough on its own?
It helps, but check the defaults. Claude Code's sandbox is off by default. When it is on, commands can still read credential files unless you deny those paths. Add deny rules for folders such as ~/.ssh and ~/.aws.
What is YOLO mode?
The common name for modes that skip approval prompts. Codex and Gemini CLI both take a --yolo flag, Claude Code has --dangerously-skip-permissions and Cursor has Run Everything. Anthropic says to use its bypass mode only in isolated environments such as containers or VMs.
Can we stop developers from using bypass modes?
For Claude Code, yes. An admin can set permissions.disableBypassPermissionsMode to disable in managed settings, which users can't override. For other agents, check each vendor's admin settings.
Are tokens in MCP config files a real problem?
Yes. GitGuardian found 24,008 unique secrets in public MCP configuration files, 2,117 of them valid. On a laptop, any agent that can read those files can read the tokens too.
Sources
- Connect to local MCP servers, Model Context Protocol documentation. Read 26 Oct 2026.
- Security, Anthropic, Claude Code documentation. Read 26 Oct 2026.
- Configure the sandboxed Bash tool, Anthropic, Claude Code documentation. Read 26 Oct 2026.
- Choose a permission mode, Anthropic, Claude Code documentation. Read 26 Oct 2026.
- Agent approvals & security, OpenAI, Codex documentation. Read 26 Oct 2026.
- Gemini CLI configuration, Gemini CLI documentation. Read 26 Oct 2026.
- Run Modes, Cursor documentation. Read 26 Oct 2026.
- s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know, Wiz, 27 Aug 2025. Read 26 Oct 2026.
- Cursor-Opus agent snuffs out startup's production database, The Register, 27 Apr 2026. Read 26 Oct 2026.
- How I Dropped Our Production Database and Now Pay 10% More for AWS, Alexey Grigorev, 6 Mar 2026. Read 26 Oct 2026.
- What xAI Grok Build CLI actually sends to xAI - a wire-level analysis (grok 0.2.93), cereblab, GitHub Gist, July 2026. Read 26 Oct 2026.
- Leaked API Keys in LLMs: How AI Agents Expose Secrets, GitGuardian, 19 Oct 2026. Read 26 Oct 2026.