Securing Agentic Coding: From Prompt to Pull Request

Coding agents inspect repositories, execute commands, install packages, call MCP tools, modify infrastructure, and open pull requests.

They act with developer and delivery-system access.

Security cannot begin at the pull request. Before it exists, the agent may have exposed context, followed an injected instruction, installed an untrusted dependency, or run a destructive command.

The Repository Is an Input Channel

A request to fix an authentication bug may cause an agent to read source code, configuration, logs, issues, and tool responses. That material may contain credentials, customer data, internal endpoints, or proprietary code, producing a sensitive outbound model call.

Repository content can also carry instructions. A malicious issue, pull request comment, README, dependency document, or crafted error message can redirect an agent that treats retrieved content as trusted context.

Rules files such as AGENTS.md, CLAUDE.md, and .cursorrules steer future runs. Review them like CI configuration. Gitignore and tool-specific ignore files may reduce indexing, but they do not enforce what an agent can read.

Runtime Protection Must Precede Execution

Control points sit inside the agent trajectory. These labels are a framework; coding agents do not expose identical hooks. Use native hooks, wrappers, gateways, sandbox controls, or CI policy where available.

• Pre-context checkpoint: Inspect and redact prompts, files, and retrieved material before model access.
• Pre-tool hook: Authorize shell commands, MCP calls, package operations, network requests, and file access.
• Post-tool hook: Inspect tool output before it becomes instructions or evidence for the model’s next step.
• Pre-write hook: Restrict paths and flag changes to CI, deployment, authentication, and infrastructure files.
• Audit hook: Record identities, actions, policy decisions, approvals, and outcomes without storing raw secrets.

Run agents in sandboxed, ephemeral environments with controlled egress and task-scoped credentials. Keep developer SSH keys, cloud tokens, production secrets, and broad repository permissions out of reach. Bind approval to the exact action, arguments, and target. Reusing approval after any of them changes turns human review into ceremony.

Protect CI Agents From Untrusted PR Content

Pull request titles, comments, and diffs can be attacker-controlled when contributors are untrusted. Review bots may hold repository write access or organization secrets. Isolate CI agents, minimize credentials, sanitize PR context, and require approval before they push code or modify workflows.

Red Team the Agent and Its Tools

AI red teaming asks whether an agent can be manipulated into creating or hiding a vulnerability, disclosing data, or abusing an approved tool.

Test multi-step paths. A poisoned issue might direct a restricted file through an allowed network tool. A malicious MCP description might steer tool selection. A rules file might persist an instruction to weaken tests or alter CI.

Test the complete configuration: model, instructions, tools, permissions, hooks, approval rules, and credentials. Turn successful attacks into regression tests and runtime policy, then retest when any of those components change.

Verify Dependencies and Generated Changes

Coding agents can introduce outdated libraries, unsafe installation scripts, and fabricated packages. The OWASP Secure Coding with AI Cheat Sheet covers hallucinated dependencies, where attackers register plausible package names invented by coding models, a pattern often called slopsquatting.

That agent-specific risk sits beside the wider developer-tool supply chain.

Microsoft analyzed a tampered copy of the Claude Code extension with the expected anthropic.claude-code identifier, versions 2.1.312 and 2.1.313. Cursor said it was served in its marketplace for about 11 hours on October 29. The loader attempted to add an SSH key, establish reverse forwarding, and configure persistence. Cursor reported that errors or administrator requirements blocked SSH access on most macOS and Windows hosts, but Microsoft notes the loader could still write keys and persistence artifacts when tunnel access failed. Microsoft does not attribute the compromise to agent behavior. An expected extension identifier is not proof of provenance.

Verify publisher identity, registry source, package age, ownership changes, integrity, known vulnerabilities, and installation scripts. Pin approved versions and require review for new dependencies. “The model recommended it” is not a supply-chain control.

Preserve Independent Assurance Before Merge

Agent-generated changes should pass secret scanning, static analysis, dependency checks, infrastructure policy, and adversarial tests. Review the full diff, especially authentication, CI configuration, deployment scripts, rules files, and dependency manifests. Tests need independent review because an agent can make CI green by weakening an assertion or deleting an inconvenient test.

The pull request shows the change; the agent trace shows how it happened. Security teams need both.

Where DeepKeep Fits

• AI Lens for Developers uses coding-agent hooks to inspect prompts, shell commands, file reads, and MCP calls, apply policy, detect sensitive data, and route destructive commands for approval.
• AI Red Teaming tests AI applications, agents, and models under targeted misuse and turns findings into prioritized mitigation.