Secret leakage used to be framed mainly as a bad commit. Coding agents create more routes: repository context, environment variables, shell output, MCP tools, logs, generated patches and outbound requests. The safer pattern is to keep credentials outside model context and issue narrowly scoped, short-lived authority only when an approved action actually runs.
Why it is movingMajor coding-agent platforms now document sandboxing, network controls, managed permissions, secure credential storage and isolated execution, while GitHub has extended push protection and secret scanning into MCP-driven agent workflows. The security boundary is moving earlier than the commit and deeper than the repository: organizations must control what the agent can read, which credentials can be obtained, where processes can connect and what evidence persists after the run.
Evidence confidence97%
Give the agent a capability at execution time, not a reusable secret in its context38 min read
Prompt injection is not merely a malicious phrase that a classifier can remove. It appears whenever untrusted content shares an inference path with instructions or capabilities, so production defenses are shifting toward provenance, information-flow policy, constrained tools, independent authorization and verified actions.
Why it is movingOpenAI frames prompt injection as social engineering against agents and recommends source-sink analysis plus controls that constrain consequences even when a model is manipulated. NIST is developing agent-hijacking evaluations. OWASP continues to rank prompt injection first among LLM application risks. Microsoft and Google are adding prompt shields, information-flow controls, model armor, least-privilege guidance and runtime protection. The engineering trend is away from trusting one system prompt and toward assigning authority to protected channels, preserving provenance and validating every consequential action outside the model.
Evidence confidence98%
Treat retrieved instructions as untrusted data48 min read