AI coding agents read files, run commands and call APIs with whatever credentials sit on the developer machine or in the CI job. The risk is rarely the agent itself. It is the token in a config file, the cloud profile in the home directory and the deploy role one step further.
cursor-ci runs in CIRecent incidents show the same pattern. In the PocketOS case a Cursor agent found an account-scoped Railway token in an unrelated file and deleted a production volume. GitSpawn showed seven coding agents running attacker code from a repository setting, as the developer. The s1ngularity payload used installed AI CLIs to hunt for secrets. And the Codex sandbox research found the agent's own authorisation token readable from untrusted code.
None of these needed a new vulnerability class. Each needed a credential the agent could read and a permission nobody had checked end to end.
PocketOS →An account-scoped Railway token sat in an unrelated file. A Cursor agent used it and deleted a production volume.
Seven coding agents ran attacker code from a repository setting, as the developer.
The payload used installed AI CLIs to hunt for secrets.
The agent’s own authorisation token was readable from untrusted code.
Agents in GitHub, CI workflows and cloud accounts, next to the ones developers installed themselves.
Cursor
Claude Code
cursor-cipr-botdocs-agentmigration-agentFive questions Elmoz answers for every coding agent in GitHub, CI and your cloud accounts.
CursorDeveloper laptopsShadowClaude CodeDeveloper laptopsSanctionedcursor-ciGitHub ActionsNo ownerAgents found in GitHub, CI workflows and cloud accounts, including shadow agents nobody registered.
GitHub tokenrepo scope · 34 daysScopedTokens, keys and roles the agent runs with, where they live and how old they are.
cursor-ciAI coding agent in CIThe path from the agent through roles and deploy identities to databases, buckets and production.
How many steps separate a coding agent from a destructive action in production.
The single change, for example scoping a deploy role off the customer database, that closes the path.
This is the kind of path Elmoz surfaces from live permissions. The fix is rarely to remove the agent.
This is the kind of path Elmoz surfaces from live permissions. The fix is rarely to remove the agent. It is usually to scope the role or rotate the one token that made the path possible.
Short answers on what coding agents can reach and how to reduce it.
Yes, if a credential it can read grants that access. Coding agents use the tokens, keys and cloud profiles available on the developer machine or in the CI job, so their reach is the reach of those credentials.
Standing credentials within the agent's reach, such as account-scoped API tokens in files or broad deploy roles in CI. Incidents like PocketOS and GitSpawn turned exactly those into production impact.
Inventory the credentials it can read, scope them to the task, keep production tokens out of developer files and review the roles CI identities can assume.
Every use case ends in the same place: a path from an identity to sensitive data.
Book a demo and we walk through the access paths in an environment like yours.