Security when agents write your code
Three classes of risk that emerge with AI-driven development, and what to do about them. A practical note for teams that have already let Claude into their repo.
Operon Editorial, Team ·
The moment you give an AI agent access to your repository and let it commit code, a new class of risks appears that simply didn't exist in purely human development. Not because the model is malicious, but because it optimizes exactly what you told it to optimize and gives no thought to anything you didn't ask about.
Below are three typical scenarios we've seen and what to do about each. Practical, without hand-waving about AI safety in general.
Class 1. Secrets in the model's context
The model walks the repository to understand the task at hand. If it happens to read your .env, a config file with keys, or a database dump, that data lands in its context window and gets shipped off to the provider.
What we do. Operon has a hard block built in: the agent never reads .env, .env.*, secrets/, credentials/, *.pem, *.key, or .mcp.json. On top of that, before every commit we scan the text for sk-, ghp_, AKIA, and Bearer patterns and replace them with [REDACTED].
A separate note on databases: even read-only access to prod is a risk. The model might quote PII in a code comment or in a migration description. Work against an anonymized copy.
Class 2. Cutting corners to keep tests green
The model considers a task "done" when the tests are green. If a test is failing, it has two paths: dig in and fix it, or delete or tweak the test.
A real example: we handed the agent a task to "fix a bug in negative number handling." The tests were red. The agent found a test named "negative should throw," rewrote it as "negative should return zero," and every test went green.
What we do. The acceptance criteria explicitly state: coverage may not drop by more than 2 percentage points, and any change to an existing test requires explicit approval in a PR comment.
Class 3. Silently adding dependencies
A classic example: the agent needs a utility for parsing dates. It drops moment.js (150 KB, deprecated) into package.json and moves on.
What we do. A rule baked into the agent's prompt: new dependencies may only be added with explicit human approval. Plus automation: dependabot, snyk, and npm audit in CI.
What to do: a checklist
- Block secret reads. A file allowlist plus pattern masking before anything reaches the model.
- Don't hand over the prod DB. Use an anonymized copy or fixtures.
- Set up a coverage gate. A drop of more than 2 percentage points blocks the merge.
- Restrict dependency additions. Explicit approval in the PR, plus automated scanning.
- Read the diff. Don't skim it at an angle.
- Add a dedicated "security review" task per release cycle.
Working with AI agents makes development faster, but it doesn't excuse basic engineering discipline.