Opinion: coding agents make developer laptops pathways into production
Original title: The developer laptop just became production. Now what?
The author argues agents reuse developer tokens and keys without human judgment, and that sandboxes do not limit that authority.
A CSO Online opinion piece says autonomous coding agents on developer laptops hold GitHub tokens, SSH keys, cloud credentials and browser sessions, so they can reach production without a separate vulnerability. It argues agents will use any available credential, that sandbox isolation does not stop misuse of legitimate permissions, and that agents should have identities separate from their developers. It describes trusted brokers or MCP proxies as a way to authorize individual operations outside the agent's control.
- A personal GitHub token can give an agent every repository that developer can reach.
- Revoking an agent that uses a developer's credentials can also disable that developer.
- The author says the agent must not set the limits of its own authority.
From the original article
6 min read at csoonline.com
For decades, enterprise software development relied on an assumption that developers could experiment relatively safely because there were safeguards between their work and production. Development, staging and production had different rules, with human intermediaries making judgments about what was ready to move forward. Testing also assumed that software would behave predictably when executed again.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.