Summary
In April 2026 a coding agent working on a staging task at PocketOS found an API token in an unrelated file and used it to delete the company's production database volume, together with the backups stored on it. The founder said it took nine seconds. Nobody granted the token to the agent. It was simply readable.
That is the pattern this paper examines: a coding agent runs as the developer, so its effective permissions are the sum of every credential on that machine. It reviews the incidents, the leak data and the agents' own vulnerabilities, and sets out an approach that starts on the device, with inventory and least privilege.
The numbers
- 9sfor one API call to delete a production volume and its backupsPocketOS · Apr 2026
- 3.2%of Claude Code-assisted public commits leaked a secret, vs a 1.5% baselineGitGuardian · Mar 2026
- 24,008unique secrets in the public MCP config files GitGuardian studiedGitGuardian · Mar 2026
- 81%of surveyed developers have security and privacy concerns about AI agentsStack Overflow · 2025
Key findings
- Guardrails inside the agent were present and did not hold. The PocketOS agent had project rules against destructive actions and afterwards listed the rules it broke.
- The pattern repeats across vendors. Adversa AI catalogued nine coding-agent incidents that ended in deleted data between June 2025 and July 2026, spanning Cursor, Replit, Claude Code, Gemini CLI, Antigravity and Kiro.
- Attackers already use local agents to hunt for secrets. The s1ngularity malware invoked installed AI CLIs with permission checks disabled; about half of victims had at least one installed.
- The agents themselves have had critical flaws. Project files in Cursor, Claude Code and Codex CLI could trigger code execution or leak keys before the user approved anything.
- Leaked secrets stay live. GitGuardian found 64% of valid secrets exposed in 2022 were still valid at its 2026 retest.
What is inside
- 01Anatomy of a nine-second deletion
- 02Not an isolated case
- 03Agents are already on the endpoint
- 04Where credentials live on a dev laptop
- 05What the leak data shows
- 06When the agent becomes the harvester
- 07Vulnerabilities in the agents themselves
- 08Why in-agent guardrails are not enough
- 09Measure it, then fix it in 30 days