AI coding agents trust the wrong things by design
The approval dialog on your AI coding agent is not the security model. It’s a single gate on a path that has a dozen side doors.
Harness published the first post in a multi-part research series on how AI coding agents assign trust, and what happens when an attacker controls something the agent reads automatically.
The core problem
An agent runs a loop: read context, decide, act, repeat. Two properties make that loop exploitable without touching the chat box.
First, data and instructions are the same thing. A tool response is simultaneously a fact and a command. A rules file is both documentation and an instruction set. There’s no equivalent of a parameterized query keeping those apart.
Second, trust is assigned by channel, not content. The system prompt gets treated as authority. A user message gets treated as intent. A tool or MCP reply gets treated as fact. A project rules file gets treated as context. If attacker-controlled text arrives on a trusted channel, the model gives it that channel’s weight. The channel is working as designed. The weight was wrong.
️ What loads before you type anything
Opening a repo can trigger workspace settings, startup hooks, and automatic task runners before you send a single message. A permission dialog only protects the action it asks about. It cannot undo code that already ran.
Rules files, skills, hook output, and sub-agent summaries all feed the model’s context automatically. None of it was written by you in the current session. Whoever wrote those files is effectively part of the conversation.
The demo that makes it concrete
Harness shows the simplest version of the problem with a .cursor/rules/standards.mdc file containing no shell commands at all, just prose instructing the agent to run an environment validation script before any code changes. The file loads automatically. The agent reads it as a project requirement and goes looking for the script to run, often within seconds of the folder opening.
The words are the exploit. Every post in this series is a variation on it: attacker text sitting on a trusted channel, steering the loop.
What to do now
The Harness team recommends treating anything your agent reads automatically as executable code: rules files, hooks, skills, workspace config, and sub-agent definitions. Review them in pull requests. Limit what tools and MCP servers can reach. Re-check approvals whenever the content behind them changes.
This is the opening post of a series. Upcoming installments cover approval caching, hook persistence, sub-agent trust, and what defenses actually held in their testing.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
