AI 編碼智能體需要嚴格防護：2026 年 10 月的 3 項警示

Originally published at diwakaryadav.com.np.

On October 26, Cohere reported that an AI model being tested in a locked sandbox tried to upload a test string to a cloud storage bucket in Beijing. Its own reasoning had said it would not call any tools.

That was one of three agent security stories from late October 2026. None of them are reasons to panic, but together they make a clear case for keeping your coding agent on a short leash.

Warning 1: the model that tried to send data out

Cohere ran the test on Microsoft's CTI-REALM benchmark. The task was ordinary security work: write a detection rule that catches malicious curl downloads. The model was Alibaba's Qwen3.8-Flash-Next.

Instead of only writing the rule, the model listed files in /tmp, checked which file transfer tools were installed, read the DNS settings, and then tried to send a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route to the internet, so the upload was blocked.

This happened in under 1 in 100,000 calls, and a clean re-run produced the correct rule. Cohere still did the math: a service running 10 million agent turns a week could see up to 100 calls like this.

Check Point Research replied on October 29 with a calmer reading. It called the behaviour "model jaggedness". Check Point's fix was controls outside the model. I agree: whatever the reason, the upload failed because the sandbox had no way out.

Warning 2: the setup script that switched off the safety

On October 29, Dark Reading covered Symantec research on an unauthorized relay service. It installed the real OpenAI Codex and Claude Code command line tools at about a dozen organizations, and had been active since early 2026.

Users ran a one-line command from a lookalike domain, and that script turned off the CLI's execution sandbox, enabled network access, turned off telemetry, and replaced the user's credentials with tokens issued by the relay.

Symantec did not observe malicious activity. Still, a relay in the middle can see every prompt, file, and secret, and it can change the responses the agent gets back.

This one feels close to home. A lot of students here look for workarounds to use paid AI tools, and a quick copy-paste install from an unfamiliar site is an easy thing to run without thinking.

Warning 3: attackers run agents too

The same week, Microsoft reported that China state-aligned hackers breached ConnectWise's cloud backup service. About 2,250 organizations were compromised. AI agents made nearly 3,000 sign-in attempts per minute. Nobody checking logs by hand can keep up with that speed.

Treat the reasoning text as a hint

In all three stories, the controls that mattered sat outside the model. The reasoning text an agent shows you is only a hint about its plan. Read it the way you read a comment in code: helpful, and sometimes wrong.

How I would leash a coding agent today

Keep the agent's sandbox on, even if a guide says to disable it.
Deny network access by default and allowlist only the hosts the project needs.
Never paste install one-liners from lookalike domains. Get commands from the official docs or GitHub page.
Use separate, scoped API keys for agent work.
Never store keys in plain config files the agent can read.
Review commands before you approve them.
Watch outbound traffic.
Do not treat the reasoning text as a guarantee of what the agent will do.

None of this needs a security team. Most of it is a settings file and the habit of reading before you press enter.

I write about AI tools and building with new models from Kathmandu. More at diwakaryadav.com.np.