A coding benchmark is not a security review: an agent can solve a small issue correctly and still have more filesystem, network, tool, or credential access than the task requires. I treat the first run as a controlled pilot—not proof that a vendor is categorically safe—and make sure its work can be inspected and discarded.
How I run a low-risk first trial
- Choose a small, bounded task. Ask the agent to explain a module, add a focused test, or make one contained change. Use a disposable clone, worktree, or isolated environment rather than a production checkout with live credentials. A sandbox can constrain where work happens, while the surrounding harness handles review, audit, and recovery responsibilities; see OpenAI’s Sandbox Agents guide.
- Map the boundary before you start. Check which paths the agent can read and write, which terminal commands or MCP tools are enabled, whether outbound network access is allowed, and where credentials reside. Sandboxing and approval policy are different controls: one constrains execution; the other determines when an action requires review. OpenAI explains their relationship in “Running Codex safely at OpenAI” (May 8, 2026).
- Grant only what the task needs. Begin read-only for review work. For an edit, allow writes only inside the trial workspace. Block network access unless the task needs it, and restrict destinations when possible. Agent-generated code can access the files, credentials, and network exposed to its environment, as OpenAI warns in its sandbox security guidance.
- Inspect untrusted repositories before processing them. Repository instructions and configuration may influence an agent. Keep Workspace Trust or the equivalent restriction enabled until you have assessed the project. In VS Code, Restricted Mode is intended for untrusted projects and disables agents in that workspace; details are in Microsoft’s secure AI-assisted development guidance. The Cloud Security Alliance recommends treating repository-resident agent configuration like executable code, with an explicit trust classification, in its README Injection note.
- Keep secrets out of the trial. Remove
.envfiles and production tokens. If access to a service is necessary, use narrowly scoped credentials kept outside the agent’s execution environment or a secret broker. OpenAI notes that agent-generated code can read the environment key and advises keeping the application API key outside the sandbox in its sandbox security guidance. - Review the complete result. Inspect the full diff, including unrelated files, dependency changes, generated scripts, and configuration. Run the project’s normal checks in the isolated workspace, and review the tool or session log if available. VS Code advises reviewing edits before commit, merge, or pull request; GitHub says its Copilot cloud-agent draft pull requests require human review and merge. See the respective VS Code guidance and GitHub risk and mitigation documentation.
- Decide what access to grant next. Note whether the agent stayed within scope, asked before crossing a boundary, treated untrusted instructions cautiously, produced understandable changes, and left enough logs to reconstruct its actions. Expand access only when a later task demonstrates a concrete need.
What permissions should I give a coding agent?
Start with the smallest permission set that can complete the trial. For explanation or review, use read-only access. For edits, restrict write access to the disposable workspace. Enable terminal commands, MCP tools, or network access only when the task requires them, and prefer specific approved destinations and narrowly scoped credentials over broad access.
As an Amazon Associate I earn from qualifying purchases.
Approval prompts are useful, but they do not replace an execution boundary. OpenAI puts it plainly: “Approvals and sandboxing work together.” Its May 8, 2026 article explains that sandboxing controls where Codex can write and whether it can reach the network, while approval policy determines when it must ask. Product controls vary, so verify the specific product, operating system, mode, plan, and version you are using rather than assuming another tool behaves the same way.
How do I protect my repo from prompt injection?
Prompt injection can arrive as ordinary-looking text in repository files, issue content, comments, or tool responses. Treat those inputs as data to evaluate, not as authority to override your instructions or widen access. Before giving an agent an unfamiliar project, inspect its agent instructions and configuration; keep trust restrictions enabled; and limit what the agent can read, execute, or send over the network.
#1 Best Overall
GitHub documents prompt injection in issue and comment content as a risk for Copilot cloud agent in its risk and mitigation guidance. The Cloud Security Alliance’s March 17, 2026 note likewise recommends classifying repository-resident configuration by trust. These are reasons to narrow the boundary before processing untrusted content—not a guarantee that any single setting eliminates injection risk.
What to compare when screening different agents
Compare concrete controls, not a general vendor description of an agent as “safe.” The answer can differ by product and mode.
- Isolation: Does the agent use a disposable workspace, worktree, OS sandbox, container, or remote environment? Which host paths and processes remain reachable? OpenAI’s Sandbox Agents guide distinguishes sandbox compute from the control-plane harness. Anthropic describes filesystem and network controls, plus Git operations mediated through a proxy for isolated cloud sessions, in its Claude Code sandboxing account.
- Filesystem and tool scope: Can file access be limited to the project? Can terminal and MCP tools be disabled or restricted? VS Code documents workspace-limited built-in file access and selective tool controls in its security guidance.
- Network and credential boundaries: Can outbound traffic be restricted? Are application secrets absent from the agent process or provided through a broker? OpenAI recommends approved outbound endpoints and keeping the application API key outside the sandbox in its sandbox security guidance.
- Approval behavior: Which actions require explicit approval? Is auto-approval scoped to a session or command, or broadly enabled? VS Code cautions that command auto-approval relies on best-effort parsing, which has limitations involving shell aliases, quote concatenation, and complex syntax; see its security guidance.
- Untrusted input handling: What happens if repository text, issue content, or an MCP response asks the agent to reveal data or run an unexpected command? GitHub’s Copilot cloud-agent documentation describes prompt injection in issue and comment content as a risk.
- Review and traceability: Can you inspect the diff, branch, tool log, and session history? GitHub documents session logs and human review expectations for its cloud agent in its risk and mitigation guidance.
- Recovery: Can you discard the trial without changing the original checkout? Can credentials be revoked if exposure is suspected? OpenAI recommends rotating or revoking credentials when exposure is suspected in its sandbox security guidance.
How to interpret broad security claims
The Cloud Security Alliance’s March 17, 2026 README Injection note reports “100% of tested AI IDEs vulnerable” and “more than 30 CVEs across every major vendor.” The note labels itself “Unofficial AI-assisted Research.” Treat those as figures reported by that document, not as a verified rate for every current coding agent or a basis for ranking vendors. Security properties change with product, mode, configuration, platform, and release.
Quick Recap
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
