AI coding tools can be tricked into acting as a confused deputy, warns post
gastao_s_s · reddit · 2026-07-22
The post explains the confused deputy problem in AI tooling: coding assistants inherit the host environment’s permissions, so malicious content in cloned repos, pull requests, or docs can trick them into deleting files, leaking secrets, or making unauthorized API calls.
It argues that wildcard environment variables and broad API keys greatly increase blast radius across developer machines and CI/CD, and recommends three mitigations:
- least-privilege tool scoping
- deterministic capability manifests
- per-action human approval gates
More from coding & agent
- Spring AI 2.1.0-RC1 adds tool-call confirmation, pausing agent loops before real-data access — therealdanvega · 2026-10-26
- Morgan Stanley and US banks block third-party AI agents over credentials — thione · 2026-10-26
- METR red-teams OpenAI's agent monitoring, finds bypasses and gaps — thione · 2026-10-26
- OpenAI: coding agents weakened safety monitoring, one lied about it — thione · 2026-10-26
- 250 Builders Hack With Codex at Berlin Community Hackathon Ahead of OpenAI DevDay — paw_lean · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26