# Your Coding Agent Should Never Hold a Credential

## Executive summary

The panel discusses the critical security challenges of building AI software factories using autonomous coding agents. The core thesis is that agents must be treated as fundamentally unpredictable actors, making simple sandboxing insufficient. Security must be enforced through strict boundaries, particularly at the egress point, and by ensuring agents never hold credentials. The discussion emphasizes managing the dynamic agent supply chain (skills, MCP servers) and adopting a principle of least privilege across all levels of autonomy.

## Key takeaways

- Agents are Unpredictable Actors: Due to their probabilistic nature, agents may perform actions outside of intended scope, even if in 'good faith.' Security must assume the potential for malicious or unintended actions, necessitating robust controls.
- Credential Management: Agents should never hold credentials. To maintain autonomy without granting full access, enforcement must be implemented at the egress point (where traffic leaves the sandbox) to prevent key leakage or unauthorized actions.
- Dynamic Supply Chain Risk: The agent supply chain is dynamic, involving not just packages but also 'skills' and 'MCP servers.' Risks arise when agents clone third-party repositories or consume external skills, creating a complex, hard-to-track attack surface.
- Beyond Sandboxing: Sandboxing alone is insufficient because agents can often escape to insecure underlying machines. Trust must be manufactured by enforcing boundaries on network access, secrets, and file system operations.

## Technical details

- Software Factory Autonomy Levels: Software factories exist at three levels of autonomy: 1) Developers direct the process using coding agents; 2) The workflow is predefined, using agents for specific tasks (e.g., testing); and 3) The agent makes all decisions on the next step, requiring the highest level of control.
- Security Controls (Agent Baseline): The Agent Baseline reference architecture proposes six controls for securing autonomous agents. Key controls include enforcing boundaries, limiting network access, and implementing least privilege.
- Prompt Injection and Trust: It is difficult to distinguish between responsible and malicious input (untrusted input). The solution is to assume no input is trustworthy and focus on creating hardened boundaries around the agent's execution environment.

## Practical implications

- Implement containerized environments (e.g., using Docker principles) to enforce strict boundaries around agent execution.
- Focus initial security efforts on controlling the egress point to prevent key leakage and unauthorized external communication.
- Adopt the principle of least privilege for all agents, scoping their access to only the minimum necessary resources at any given time.
- Start by consolidating workflows and standardizing agent usage across the organization to improve security and usability.

## Topics

AI Security, Agentic Workflows, Software Factory Architecture, DevSecOps, Supply Chain Security, Least Privilege, Agent Baseline, Tessl

Source: https://www.youtube.com/watch?v=AsNb4Y638J4