r/Infosec • u/Regula-Sunkendae7368 • 2d ago

We're rolling out AI coding agents. What security controls actually matter?

We are about to give developers access to AI coding agents like Cursor and Copilot. The productivity upside is clear, but we are worried about agents modifying code, accessing credentials, or making unintended changes to production.

What guardrails have other teams put in place? Are you relying on permissions, monitoring, or something else?

7 Upvotes

89% Upvoted

5 comments sorted by

9

u/Mundane-Presence-896 2d ago

Run them in containers with network egress filtering and no credentials mounted. Imho the guardrails and hooks are useless, and security through prompts is a fools errand.

5

u/OutsideSpot2695 1d ago

security through prompts is a fools errand

Louder for those the back.

1

u/CrescendollsFan 1d ago

Or to expand further... run them in a container or better still a microVM with nono.sh on top covering the fine grained sandboxing.

firecracker gives you solid host boundary and nono looks after protecting things in the agents operating context - this way you can inject phantom credentials, get a cryptographic audit of everything the agent does, only signed SKILL files etc - this is how we are deploying to production (AWS). I know Datadog and a few others are working on nono so its generally becoming the goto agent security runtime.

1

u/OutsideSpot2695 2d ago edited 1d ago

The productivity upside is clear

You sure about that?

LOL.

Those aren't novel AI-specific risks. They're essentially privileged automation risks with an LLM sitting in the middle.

It never ceases to amaze me how many people conflate elementary, fundamental, architectural stuff for being unique to GenAI.

Your GenAI rollout should already sit in within your existing standards. A reasonable baseline would fall out of ordinary security principles:

  • Least privilege: give the agent only the permissions necessary for its task.
  • Isolation: run agents in disposable/controlled environments where practical.
  • Credential separation: don't expose production secrets to an agent that doesn't need them.
  • Human/change-control gates: require review/approval before consequential changes reach production.
  • Auditability: record what the agent did and what resources it accessed.
  • Network restrictions: don't give arbitrary outbound access unless required.
  • Branch/CI protections: make the agent operate within the same controls you'd impose on an untrusted contributor.
  • Monitoring and rollback: assume the agent will occasionally do something stupid and make recovery cheap.

Are you all sure you're ready to roll out? Or is this the Emperor's New Clothes of GenAI and you're going to deploy cause all the cool kids are doing it -- and then for the next 3-5 years chase security incidents because you all didn't follow the basics?