# AI Coding Agent Risks and How to Reduce Them > Is an AI coding agent safe? A plain-English guide to what can go wrong, from deleted files to leaked passwords, and the simple controls that lower the risk. 17 October 2026 · Plain English · Explainer · 7 min read · https://bridge-terminal.com/atlas/blog/ai-coding-agent-risks-what-can-go-wrong/ ## The short version - The main risks of an AI coding agent are unwanted changes, deleted or leaked data, work that looks finished but is not, and being tricked by hostile text it reads. - The agent can only do what it is allowed to do, so most of the risk is managed by deciding in advance what it may touch and what needs a person's yes. - Keep real customer data, live systems and passwords out of the agent's reach until you have watched it work safely on something harmless. - You are responsible for reviewing what an agent proposes, but approval prompts get tiring, so safer set-ups limit the agent's reach instead of relying on careful clicking. - Never skip the way back: a backup you have restored once and a clear plan to undo a release matter more than any promise about the AI. Is an AI coding agent safe to use? Mostly yes, if you decide in advance what it may touch and what needs a person's approval. The real risks are not science fiction. They are ordinary: a wrong change, a deleted file, a leaked password, or code that looks finished but is not. This guide lists what can go wrong, in everyday terms, and the controls that keep each risk small. You do not need to read code to apply them. ## What can actually go wrong with an AI coding agent? An AI coding agent is a program that reads your project, writes changes and runs commands on a computer, much as a junior engineer would. Because it can act, not just chat, its mistakes have consequences. Here are the five that matter most. ### 1. It changes things you did not ask for You ask for a new checkout button. The agent also "tidies" the pricing logic. Nothing crashes, but a discount stops working. This is a common problem and a hard one to notice, because the app still runs. **Keeping it small:** say clearly what is in and out of scope, and ask for a short summary of every change in words you understand. ### 2. It deletes or overwrites something Agents run commands, and some commands remove or replace files. Anthropic's documentation for Claude Code describes an "Accept Edits" mode that automatically approves file edits plus a fixed set of file commands, including ones that remove, move and copy files, for paths in the working folder. That is convenient, and it also means a mistake in that folder does not stop to ask. **Keeping it small:** the agent should work on a copy of the project, with the history saved, so any change can be undone. Ask your engineers one question: "If the agent wrecked this folder right now, how long would it take to get back?" The answer should be minutes. ### 3. It leaks a secret Secrets are passwords, access keys and tokens that unlock your database, payment provider or cloud account. They leak when someone pastes one into a chat, or when one is saved inside the code itself, where many people can see it. **Keeping it small:** do not paste secrets into a chat with an agent unless the tool puts them straight into a secure store. Give the agent separate keys with limited power, and replace any key that was ever exposed. ### 4. It produces work that looks done but is not An agent can write the code, say "all tests pass", and still be wrong, for example because it wrote weak tests or tested the wrong thing. This is a quality risk rather than a security one, and many teams meet it first. **Keeping it small:** do not accept "done" on the agent's word. Ask for evidence: screenshots of the screen working, a list of the test cases and what each one proves, and a second pair of eyes (another agent or a person) reviewing before release. ### 5. It is tricked by text it reads This one sounds odd. Prompt injection is when someone hides instructions inside content the agent reads, such as a web page, a document or a support ticket, hoping the agent will obey them instead of you. Anthropic's security documentation describes it as an attempt to override or manipulate an AI assistant's instructions by inserting malicious text. The same page says that no system is completely immune to all attacks. **Keeping it small:** limit what the agent can reach on the internet, be wary of pointing it at content you did not write, and keep it away from systems it does not need. If it cannot reach your customer data, a trick cannot make it leak that data. ## Why does "ask me first" matter? Most agents have permission settings. They decide which actions the agent may take alone and which need your approval. Anthropic's documentation describes two main modes in Claude Code. In Manual mode, the agent starts with read-only permissions. It asks before it edits files, runs tests or executes commands, and it asks before running a command it cannot fully analyse. A built-in set of read-only commands, such as listing files, runs without asking. In Auto mode, a separate reviewing model checks actions instead of you and blocks the ones it judges unsafe. Your own "always ask" and "never allow" rules still apply. The documentation lists Auto mode as the starting mode for interactive terminal sessions, so check which mode your own set-up uses. ### The approval fatigue problem If an agent asks 200 times a day, people start clicking "yes" without reading. Anthropic's documentation says you are responsible for reviewing proposed code and commands before approving. A safer approach is to cut the number of questions by limiting what the agent can do at all. Two ways the documentation describes: - **Allow and deny rules.** You list things the agent may always do and things it may never do. For example, you can block commands that fetch content from the web. - **Sandboxing.** The agent's commands run in a walled-off space with limits on which files and which network addresses they can reach. That means fewer prompts, and a smaller blast radius if something goes wrong. ## How do I keep the risk low in practice? You do not need to be an engineer to run these checks. They are decisions about your project, and they are yours to make. ### Start with something harmless Let the agent build a prototype, an internal tool or a copy of the project with fake data first. Watch how it behaves. Widen its reach only after it has earned it. ### Separate three worlds - **Experiments:** fake data, nothing at stake. - **Test or staging:** a rehearsal copy of the real thing, with realistic but not real data. - **Production:** the live product and real customers. The agent can work freely in the first, with care in the second, and should reach the third only through a release step a person approves. ### Keep a person on the irreversible decisions Some decisions should never be automatic. A good short list: going live in production, spending money, deleting data, sending anything to the outside world, and dropping part of the scope. If your set-up lets the agent do these alone, change it. ### Make the way back real Before any release, ask three things: 1. Is there a marked point we can return to? 2. Is there a backup of the data, and has anyone actually restored it once to prove it works? 3. If the release changes the database, was that change rehearsed on a copy first? A backup you have never restored is a hope, not a backup. ### Watch the cost as well Risk includes money. An agent left running can use a lot of your plan's allowance, and several agents at once use it faster. A daily limit or budget alert is a simple safety net. ## How does Atlas handle these risks? Atlas is a software team of AI engineers built on Claude Code. You talk to one of them, PA, in plain words, and PA shares the work out to specialists. Some decisions are never made for you: production go-lives, spending, deleting data, sending anything outside, and dropping scope. Releases beyond the Mac follow eight steps: the way back is marked, data is backed up and the backup is proven by restoring it, database changes are rehearsed on that copy, then the release goes out and is checked. Secrets pasted into chat go to a secret store first. An optional daily budget warns at 50% and 80% and pauses the team at 100%. You can read more at [Atlas](https://bridge-terminal.com/atlas/). Atlas does not claim to defend against every attack, and it makes no specific claim about prompt injection. Nothing can promise that, and Anthropic says as much about its own tool. ## A short checklist before you let an agent loose - Is the work on a copy, with history saved? - Does the agent have only the access it needs, and no real customer data yet? - Are secrets kept out of chats and out of the code? - Is "done" backed by evidence, not just a statement? - Does a person approve production releases, spending and deletions? - Have you restored a backup at least once? ## Conclusion AI coding agents are not reckless by nature, and they are not magic. They do what their permissions allow, and they do it fast. Treat one like a new contractor: give it a clear brief, limited keys, a place to work that cannot hurt the business, and a person who signs off on anything that cannot be undone. Do that, and the risks above become small, known and manageable. ## Questions people ask ### Is it safe to use an AI coding agent on my real project? It can be, if you limit what it can reach. Work on a copy with saved history, keep real customer data and passwords out of its reach at first, and have a person approve production releases. ### What is prompt injection in simple terms? It is when someone hides instructions in content an AI reads, such as a web page or document, hoping it obeys them instead of you. Anthropic says no system is completely immune, so limit what the agent can reach. ### Can an AI coding agent delete my files? Yes, if it is allowed to run commands that remove files. In Claude Code's Accept Edits mode, file edits and a fixed set of file commands, including remove, move and copy, are auto-approved for paths in the working folder. Work on a copy with history saved. ### Should I paste passwords or API keys into an AI chat? No, unless the tool sends them straight to a secure store. Use limited-power keys for the agent and replace any key that was ever exposed. ### How do I know the AI's work is actually finished? Ask for evidence rather than a statement: screenshots of working screens, a list of test cases and what each proves, and an independent review before release. ## About Atlas: Keeping the irreversible decisions with a person Atlas never decides production go-lives, spending, deleting data, sending anything outside or dropping scope for you. Releases beyond the Mac mark the way back, back up data and prove the backup by restoring it. Secrets pasted into chat go to a secret store first, and an optional daily budget pauses the team at 100%. — https://bridge-terminal.com/atlas/ ## Sources - [Claude Code security](https://code.claude.com/docs/en/security) - [Claude Code: Configure permissions](https://code.claude.com/docs/en/permissions) _Researched and drafted with Claude, then checked against the sources above. Atlas is an independent product, not affiliated with Anthropic or OpenAI._