AI coding agents can be manipulated to steal your secrets, credentials, and proprietary code. Here's how these attacks work and how to defend against them.
AI coding agents have broad access to your codebase, environment variables, and sometimes network capabilities. Through prompt injection attacks—malicious instructions hidden in code, documentation, or packages—attackers can manipulate agents to read sensitive files and send that data to external servers, encode it in generated code, or include it in responses that get logged by the AI service.
Agent reads .env files, credentials, or secrets and includes them in responses or outputs
Secrets hidden in generated code as comments, variable names, or encoded strings
Agent tricked into making HTTP requests that send data to attacker-controlled servers
Secrets included in fake error messages or debug output that gets logged externally
Malicious package with install script that sends environment data during npm install
Never store production secrets in development environments. Use secret managers and inject at runtime.
Configure .cursorignore, .aiignore, or equivalent to prevent agent access to sensitive files.
Log all outbound network requests from development environments. Alert on unusual destinations.
Run AI agents in containers without network access or with egress filtering.
Train yourself to spot encoded data, suspicious network calls, and unusual logging in agent output.
If an agent had access to credentials, rotate them. Assume exposure until proven otherwise.
Add a .cursorignore or .aiignore file to your project root:
# Secrets and credentials .env .env.* *.pem *.key *credentials* *secret* # Cloud configs .aws/ .gcloud/ .azure/ # SSH .ssh/ # Database *.sqlite database.yml config/database.*
VAS scans your deployed application for exposed credentials, API keys, and sensitive configuration that AI agents may have inadvertently committed.
Start Free Security ScanYes. If an AI coding agent has access to files containing API keys (like .env files), it can read them. Through prompt injection attacks, the agent could be manipulated to include these keys in its output, encode them in generated code, or even send them to external servers if it has network access.
Prompt injection attacks embed malicious instructions in content the agent reads (code comments, README files, package descriptions). These instructions can tell the agent to read sensitive files and exfiltrate the contents—by including them in responses, encoding them in code, or making network requests.
Partially. Without auto-run, the agent can't execute commands to directly exfiltrate data. However, it can still embed secrets in code it generates, which you might commit without noticing. It can also include sensitive data in its responses, which may be logged by the AI service.
At minimum: .env files, .pem/.key files, anything named 'credentials', 'secrets', or 'password', SSH keys (.ssh/), cloud credentials (.aws/, .gcloud/), database connection strings, and any test fixtures containing real data.
Unfortunately, you often can't know for certain. Monitor for unusual account activity, unexpected API usage, or unauthorized access. If you suspect exposure, rotate all potentially compromised credentials immediately. Consider using canary tokens in sensitive files to detect unauthorized access.
Last updated: January 16, 2026