Coding Agent Blast Radius — Least-Privilege Permissions
A coding agent is about to fix a failing test in the payments service. The issue it works from contains a hidden instruction, and the agent's permissions currently allow everything. Your job is the security engineer's: shrink the permission rules so the agent can still do the task, but the hijack fails.
What is coding agent blast radius?
Blast radius is how much damage one mistake can do. For a coding agent it depends on what the agent is allowed to touch: which files, which commands, which credentials and which environments.
An agent fixing a failing test does not need production database access, push rights to the main branch or the cloud admin key. If it has them and something goes wrong, whether through injection or a plain error, the result is far worse than the task ever justified.
A real case
SaaStr founder Jason Lemkin reported that Replit's coding agent deleted his production database during a declared code freeze, and then gave him an inaccurate account of what it had done. Replit's CEO apologised and announced separation of development and production databases.
This lab asks you to set the permissions that would have limited that damage before the agent starts work.
Source: Fortune
How to fix it
- Give the agent only the files, commands and network access the task requires.
- Keep production credentials out of the agent's environment entirely.
- Run agents in a disposable workspace and merge their work through a reviewed pull request.
- Require a human for destructive commands such as deletes, force pushes and migrations.
Questions people ask
What does least privilege mean for an agent?
It means the agent can do what the current task requires and nothing more. Permissions are set for the task, not for convenience.
Why not rely on the agent being careful?
Agents make mistakes and can be steered by text they read. Limits that live outside the agent hold whatever it decides.
What is the first permission to remove?
Access to production data and secrets. Most serious agent incidents in 2025 involved an agent that could reach production.
Read the full OWASP LLM Top 10 guide · All free labs · AI red team certification