Securing AI Coding Agents in AI Security & Guardrails

Securing AI Coding Agents is a chapter of the free AI Security & Guardrails tutorial with 4 lessons: Coding-Agent Threat Model, Permissions & Sandboxing, Poisoned Repos, Issues & MCP and Capstone. Plan on about 150 minutes. It has 14 exercises you run and check in your browser.

What each lesson covers:

  • Coding-Agent Threat Model: Your coding agent reads issues, comments, READMEs and MCP descriptions, holds your secrets and has a shell. Map what it reads, runs and sends, and find the lethal trifecta.
  • Permissions & Sandboxing: The agent reads .env and curls it out. Deny secret reads, sandbox the shell, allow-list the network and commands, so build, test and install still work, in each tool's real settings files.
  • Poisoned Repos, Issues & MCP: A README installs a backdoor, an issue asks for your .env and a repo ships its own MCP server. Block risky actions with PreToolUse hooks and allow-list project MCP servers.
  • Capstone: Your whole security pack against 25 attacks from every lesson and all honest traffic, with both threat models and a validating export. Pass to download the v2 pack.

Before you start, it helps to have finished Agents and Production, because these lessons build on it.

When you finish, continue with Reference.

Lessons in this section

  1. Coding-Agent Threat Model

    Your coding agent reads issues, comments, READMEs and MCP descriptions, holds your secrets and has a shell. Map what it reads, runs and sends, and find the lethal trifecta.

    • List every untrusted input a coding agent reads
    • Map what the agent can read, run and send
    • Spot the lethal trifecta in a repo
    • Turn each risk into a setting
  2. Permissions & Sandboxing

    The agent reads .env and curls it out. Deny secret reads, sandbox the shell, allow-list the network and commands, so build, test and install still work, in each tool's real settings files.

    • Deny secret reads in each tool
    • Explain why a sandbox is needed on top of a deny-list
    • Allow-list the network without breaking installs
    • Allow-list commands that run without asking
  3. Poisoned Repos, Issues & MCP

    A README installs a backdoor, an issue asks for your .env and a repo ships its own MCP server. Block risky actions with PreToolUse hooks and allow-list project MCP servers.

    • Find where poisoned instructions hide in a repo
    • Explain how PreToolUse hooks work in each tool
    • Write a hook that blocks by effect
    • Allow-list a repo's MCP servers
  4. Capstone

    Your whole security pack against 25 attacks from every lesson and all honest traffic, with both threat models and a validating export. Pass to download the v2 pack.

    • Run the capstone suite and read its grade
    • Trace a failing family back to its lesson
    • Use the v2 pack in your own repo
    • Run the attack suite in CI