All topics

Enterprise AI agent security

Claude Code credential access

If a developer can read a credential, Claude Code often can too — unless you enforce a different permission boundary for the autonomous actor. Credential access is the fastest path from "helpful coding assistant" to incident.

Control point

Separate the developer’s authority from the coding agent’s — enforce at shell, MCP, and file operations.

Developer session

Human intent

Coding agent

Claude Code · Cursor · Codex

Repo & tests

Typically allow

Credentials

Agent block

Prove exposure in your environment

The AI Agent Exposure Assessment runs Audit Mode on a pilot developer group for fourteen days and delivers evidence your security leadership can act on — then you enforce what matters.

Get your exposure report

Typical failure mode

  • Agent asked to "fix the deploy" reads ~/.ssh, .aws, or vault-export files.
  • Tool and shell access reuse the user's identity without a narrower agent scope.
  • Alerts fire after exfiltration; nothing blocked the read at attempt time.

Control model

  • Human allow, agent block on sensitive paths and secret stores.
  • Normalize actions (read, write, exec) independent of prompt wording.
  • Record every decision for audit and CISO reporting.

Common questions

Can we allow Claude Code in the repo but deny credential files?

Yes. Policy attaches to actor context — the same human may read a key while the agent session is blocked from that path.

Related