Coding-agent and CI hardening

What it is for

Coding agents read untrusted text all day (issues, pull requests, comments, dependencies, web pages) and many can run commands, edit files and push code. In CI they often hold the repository’s secrets. That combination needs a baseline, not trust.

What we look at

• The permissions each agent runs with on laptops, in containers and in CI.
• Hooks, auto-approval settings and allow-lists for commands and network access.
• Whether an instruction planted in an issue, a pull request title or a dependency’s README can steer the agent.
• Whether the agent can leave its sandbox or reach secrets it does not need.
• Multi-agent harnesses that run teams of agent sessions.

An example: OpenRig

OpenRig is an open-source, Apache 2.0 harness for running persistent teams of AI coding agents. Its own README warns that it grants broad default permissions, rewrites trust settings and executable hooks in home and project configuration files, sends activity metadata, and runs install steps that can change the machine, and advises backing up those files before first use.^⁠[1] That candour is useful: it is the list of things AG3 hardens.

OWASP lists the underlying risks as ASI05 Unexpected Code Execution and ASI01 Agent Goal Hijack.^⁠[2]

What you receive

A baseline per agent and harness, a hook and approval policy, and test results for sandbox escape and injection, mapped under the TriOngle Method.