How to Secure AI Coding Harnesses in the Enterprise
Summary
AI coding harnesses can access shells, files, networks and credentials, creating risks from prompt injection, data exposure and untracked activity. The article recommends enforced sandboxing, centrally managed policies, short-lived secrets, trusted repositories and tool
Key points
- Coding harnesses can read and modify files, run shell commands, install tools and use the permissions of the user who launched them.
- The article identifies risks including source-code exposure, weak sandboxing, indirect prompt injection, unsafe extensions and MCP servers, credential access, and limited activity logging.
- Pillar Security found an Antigravity file-search parameter could run arbitrary binaries and bypass Secure Mode; Google patched the issue in February 2026.
- CVE-2026-26268 involved a repository-supplied Git hook that could run when Cursor's agent executed a Git command; the article says it was fixed.
- CVE-2026-22812 involved OpenCode starting an unauthenticated local HTTP server with open CORS that could allow websites to run shell commands; the article says it was fixed.
- Recommended controls include enabling or supplying isolated sandboxes, enforcing centrally managed permissions, using short-lived credentials, and restricting access to trusted repositories and MCP servers.
- The article also recommends logging agent tool calls, retaining session transcripts, using CI checks, requiring human review, and giving non-developers more restricted environments.
Article Details
- Defense Focus
- Reduce the security risks of AI coding harnesses by restricting their access to shells, files, networks, and credentials, and by making their activity observable and governed.
- Detection Methods
- Use hooks to log every agent tool call and shell command to the SIEM.
- Retain agent session transcripts for review.
- Scan the agent's working tree for secrets.
- Scan rules files, MCP configurations, and Git hooks before an agent accesses a fresh clone.
- Verify that centrally managed policies are enforced on endpoints.
- Data Sources
- Agent tool-call and shell-command logs
- Agent session transcripts
- Agent working trees
- Repository rules files, MCP configurations, and Git hooks
- Endpoint policy-enforcement state
- Rule Types
- Managed policy-as-code, including deny rules, file-access restrictions, MCP allowlists, and operation approval policies
- Platforms
- SIEM
- Mobile device management
- Continuous integration
- Operating-system-enforced sandboxes
- Containers or virtual machines
- Cloud-sandboxed or browser-hosted environments
- Defensive Actions
- Enable vendor sandboxes; where they are absent or minimal, run agents in an organization-provided container or virtual machine.
- Make disabling a sandbox a privileged action that is logged and approved.
- Deploy centrally managed policies and verify enforcement on endpoints.
- Use short-lived credentials, keep long-lived credentials out of shell profiles, and deny access to .env, ~/.ssh, and cloud-configuration directories.
- Keep workspace trust enabled; allowlist MCP servers and extensions, and pin harness versions.
- Use CI gates and require review by a human who can read the diff.
- Use tiered harness access: reserve local shell agents for professional developers under managed policy, and provide citizen developers with cloud-sandboxed or browser-hosted options and guarded templates.
MITRE ATT&CK
CVE
CVE-2026-22812server with open CORS, so any website the developer visited could run shell commands on the machine (CVE-2026-22812). Although all of these were fixed, the pattern is not.CVE-2026-26268to run arbitrary binaries, bypassing Secure Mode; Google patched it in February 2026. In Cursor, CVE-2026-26268 let a repository ship a booby-trapped Git hook that fired the moment the agent ran a Git command, no
Vendors
Anthropicmanaged policy, MCP allowlists, audit logs, spend caps and some intellectual property indemnity. Anthropic's Enterprise plan covers SSO, SCIM, audit logs and managed policy for Claude Code; the Team plan getsCursordo next. The harness gives it hands. Swap the model, and the harness is still the product, which is why Cursor now describes its harness as the thing it sells and the editor as a front end to it. Its April 2026GitHubCredential risk: The agent has the shell. The shell has ~/.aws, the kubeconfig, the GitHub token, the SSH keys and a logged-in cloud CLI. The agent will use any of them if it decides that helps.Googlein the built-in file-search tool could be abused to run arbitrary binaries, bypassing Secure Mode; Google patched it in February 2026. In Cursor, CVE-2026-26268 let a repository ship a booby-trapped Git hookOpenAIand managed policy for Claude Code; the Team plan gets managed settings without the identity controls. OpenAI's Business and Enterprise tiers do the equivalent for Codex, as do Cursor's and GitHub Copilot's business
Products
Antigravityinclude Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most of them, where the agent runs onClaude CodeThe rough map: terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most ofCodex CLIThe rough map: terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most ofCopilotThe rough map: terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most ofCopilot CLIThe rough map: terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most ofCursordo next. The harness gives it hands. Swap the model, and the harness is still the product, which is why Cursor now describes its harness as the thing it sells and the editor as a front end to it. Its April 2026JetBrainsPi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most of them, where the agent runs on vendor infrastructure and hands back a pullOpenCodeThe rough map: terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most ofPiThe rough map: terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi and Copilot CLI; IDE-shaped ones include Cursor, Antigravity and Copilot inside VS Code and JetBrains; and cloud variants of most ofVS CodeVS Code is a workbench in which a human edits with some help from extensions. Even with an AI assistant installed, the assistant proposes and the human accepts. The blast radius is roughly the file that is open.