Very interesting paper on how secure coding agents actually are Bookmark this one, it's worth reading later They reviewed 40 harnesses and 10 security mechanisms, then hid malicious instructions in docs, MCP tools and dependencies to see if the agent would execute them while still doing the real task It's like leaving fake notes from the boss around the office and counting how many the new intern follows The image is the map of that, each column is a harness and each row is a mechanism - AA auto-approve, the agent acts without asking - NI network isolation, blocks internet access - CAL command allowlist, only runs allowed commands - CDL command denylist, blocks dangerous commands like rm -rf - MCP permissions over which MCP tools it can use - PIF prompt injection filter - PR path restriction, only touches files inside allowed paths - RO read-only, can't modify anything - AL audit log, records what it did - PT project trust, decides whether to trust the repo config Green is on by default, yellow you have to turn on yourself, red doesn't exist and gray couldn't be determined Almost everything is yellow, and the closed-source products on the right are almost all gray Harnesses: - Claude Code - Codex CLI - Gemini CLI - gptme - Qwen Code - GitHub Copilot Model GLM-5.2 Benchmark 23 tasks, 2,500 runs With auto approve the attack worked 96% of the time, security you don't turn on doesn't exist