Chapter Twelve · Security
Security
Only what is new because an agent sits in the loop: secrets that leave the machine the moment they are read, instructions hidden in the content it reads, package names it invents and attackers register, the insecure shortcuts it copies from public code, and the credentials that decide how bad any of it can get.
Security for code an agent writes is mostly ordinary security. Injection is injection, a missing ownership check is a missing ownership check, and the canon that catches them is taught in CyberSecurity Deep Dive. This chapter does not repeat it. It covers the five things that change when a model reads your repository, runs commands with your credentials, and writes code at a speed no reviewer matches.
It opens on secrets, because everything the agent reads becomes part of a request that leaves your machine, and from there it goes to more places than you can reach. Then the risk that belongs most to agents: text the agent reads that tells it what to do, with Cragmoor's canonical case, a dependency's README that slips a download-and-run step into the build. Then the package names the agent invents, which attackers register precisely because the same invented names come back. Then the insecure patterns it reproduces fluently, with a member search that breaks on a climber called O'Brien. And last, the credentials the agent acts with, which put a ceiling on every other risk in the chapter.
Cragmoor appears on every page: the staging database password in a pasted stack trace, the calendar-export dependency's README, a time-zone package registered 19 days before the agent suggested it, the O'Brien search, and the waitlist offer email that must never reach a real member from a test.