AI Coding Tools Are Privileged Agents. Most Governance Programs Don't Treat Them That Way.

What happened

Why it matters

• ·AI coding assistants typically run with access to source code, cloud credentials, and deployment pipelines. If governance teams have not classified these tools as high-risk agents, the credential theft and unauthorized-action scenarios described in the guide fall outside any existing control program.
• ·The attack paths here run through ordinary developer artifacts: a poisoned comment or a malicious MCP tool description is enough to redirect an AI agent. Controls that focus only on what users type into an AI tool, rather than what the tool reads from the environment, will miss this entire class of risk. Research on 253 MCP server bugs and authorization bypasses confirms this is an active, not theoretical, exposure.
• ·Stolen credentials obtained through a compromised AI coding tool can reach cloud environments, production systems, and third-party services. The blast radius extends well beyond the development environment, making this a broader enterprise risk management issue, not just a developer security concern.

Governance controls affected

What to do now

• ☐Ask your engineering and IT teams for a list of every AI coding assistant in use, including which external services each tool can connect to through plugins or MCP integrations, and whether those connections have been formally approved.
• ☐Require that AI coding tools operate under a maintained list of permitted external connections (an allowlist), and that any connection not on the list is blocked by default, rather than permitted unless explicitly denied.
• ☐Confirm that AI coding tools are configured to use short-lived credentials (access keys that expire in hours, not days or indefinitely) so that stolen credentials cannot be reused after a brief window.
• ☐Establish a policy requiring human approval before an AI coding tool can take any action that modifies a production system, commits code to a shared branch, or accesses secrets stored outside the immediate project.
• ☐Add AI coding tools to your organization's secret-scanning program so that credentials inadvertently placed in a codebase, configuration file, or rules file are detected before an AI tool can read and transmit them.

What to watch next

The MCP ecosystem is expanding rapidly, and each new server connection a coding tool can reach extends the attack surface described in this guide. Compliance teams should monitor for updated guidance from the OWASP Top 10 for Large Language Model Applications community and from the CIS MCP benchmark work already underway. Regulators focused on software supply chain integrity are likely to treat AI coding tool configurations as part of the secure development lifecycle. This includes regulators applying the EU Cyber Resilience Act. Organizations in regulated sectors should expect examiners to ask whether AI-assisted development pipelines are covered by existing secure development and change-management controls.