Coding agents pass security configuration checks every day, then get hijacked by a single malicious GitHub issue. That's the gap between what security teams think they're protecting and what's actually happening in developer environments. Configuration audits tell you how an agent was set up; they don't tell you what it did after that setup, what it was tricked into doing by injected instructions, or what sensitive data it accessed and sent out in the minutes after the last scan ran.

What's the Difference Between Configuration Security and Runtime Security?

The distinction matters because developers often disable safety features to reduce friction. Many teams enable "YOLO mode" (called bypassPermissions in Claude Code, 'never' in Codex, or 'Run Everything' in Cursor) to skip approval steps for every action. Sandboxing is optional in Claude Code and disabled by default in other tools. Third-party Model Context Protocol (MCP) servers, which are integrations that extend an agent's capabilities, get installed from public marketplaces without security review.

These configuration choices create the conditions for attacks, but they're not the attacks themselves. A correctly configured coding agent can still be compromised at runtime. Prompt injection happens mid-session, not at setup time. An agent that passes every posture check can be redirected by malicious instructions hidden in a GitHub issue it reads as part of a normal task.

How Do Attackers Actually Compromise Coding Agents?

The attack patterns are becoming clearer as more teams deploy agents at scale. Threat researchers have identified several runtime attack vectors that configuration audits cannot detect:

• Prompt Injection via External Content: An agent reads a GitHub issue, a web page, or an MCP server response that contains hidden instructions telling it to steal credentials or modify files. The individual actions the agent takes are all authorized; the relationship between them is the attack signature.
• Credential Exfiltration After Ingestion: An agent accesses a sensitive file like.env or an SSH key, then immediately attempts a network call to an external endpoint. The temporal relationship between reading secrets and sending them out is the detection signal that posture checks miss.
• Persistence Through Configuration Writes: An attacker-controlled agent writes malicious instructions to CLAUDE.md, ~/.claude/settings.json,.git/hooks, or similar configuration files. These changes survive session termination and load automatically at the next startup, giving the attacker permanent access.

None of these attacks require the agent to violate its permission settings. They exploit the gap between what an agent is allowed to do and what it should actually be doing in a given context.

What Security Tools Are Emerging to Close This Gap?

The security landscape for coding agents is fragmenting into two layers. Posture management tools scan configurations and flag misconfigurations. Runtime detection tools monitor what agents actually do during execution. The most comprehensive approaches combine both.

On the containment side, new tools are emerging to gate agent actions before they execute. Belay, an open-source security layer launched on July 27, 2026, sits at the boundary between an agent and its tools, gating every command, file read, and MCP call in under 100 milliseconds with no cloud round-trip required. It supports 11 different agents including Claude Code, Codex, Cursor, and others, and uses deterministic rules tagged against security frameworks like OWASP Top 10 for Agentic Applications and MITRE ATLAS.

Claude Code itself includes built-in guards: subagent tool allowlists and denylists that restrict which tools a subagent profile can access, hook lifecycle events that validate or reject commands before execution, and CLAUDE.md policy files that define which operations are permitted and which require confirmation. However, these guards only work within the Claude Code runtime and rely on the agent respecting the constraints; a jailbroken or prompt-injected session could bypass them.

Codex CLI takes a different approach, running generated code inside a Docker container by default to provide a hardware-level boundary between the agent and the host system. This is effective against destructive commands and reverse shells, but the tradeoff is granularity: Docker is all-or-nothing, so you cannot selectively allow a specific file read while denying secret exfiltration from the same container.

Steps to Build a Practical Safety Stack for Multiple Coding Agents

• Layer 1: Posture Management: Continuously monitor permission mode configurations across all agents in your environment, flag permissive settings like YOLO mode, and alert when agents operate without approval gates. Inventory MCP server connections and flag unreviewed third-party integrations.
• Layer 2: Runtime Detection: Deploy stateful threat detection that monitors execution trajectories in real time. Flag sessions where an agent accesses a sensitive file and then attempts an unauthorized network call, or installs packages immediately after ingesting external content. Detect writes to agent configuration files that weren't initiated by explicit developer action.
• Layer 3: Tool-Call Gating: Use an agent firewall or MCP proxy to intercept and validate every tool call before execution. Gate commands deterministically, scan tool responses for embedded injection markers, and maintain hash-chained audit logs that prove what happened and when.

The choice of which tools to deploy depends on your threat model. If you run multiple coding agents and are concerned about secret exfiltration, supply-chain skill attacks, and MCP tool abuse, a unified security layer like Belay provides the broadest coverage. If you use only Claude Code and want lightweight constraints without a separate daemon, the built-in hook system is sufficient but does not address threats like prompt injection or secrets exfiltration. If your primary concern is destructive commands during code generation and you do not need selective access control, Docker sandboxing like Codex CLI offers strong but coarse-grained protection.

The fundamental insight is that coding agent security is no longer a configuration problem. It's a runtime problem. As agents become more powerful and more integrated into developer workflows, the safety layer between them and your system has become a first-class architectural decision, not an afterthought.