Who it's for
Engineering leaders letting AI agents work in their repositories.
You'll be able to
Name the main risks of agent work and the controls that answer each one.
An agent reads text from anywhere and can run commands. That makes secrets, untrusted input and new packages the three places to watch.
Secrets stay out of the repository
Keys, passwords and tokens never belong in a repository. They live on the one machine that needs them, or in a secret store. An agent writes code fast, and it can paste a token into a file just as fast.
So the gate scans for secrets. Before a commit, it scans what is staged. Before a push and in CI, it scans the tracked files and every commit on the branch, so a secret added in one commit and removed in the next is still found. The scan reports where a secret is, without printing the secret itself. Its settings come from the main branch, so a change can't add an exception for itself.
If a secret does get out, stop, tell the owner the same day, and change the secret. Then write down what happened and what rule or check now prevents it.
Untrusted text is an instruction
Prompt injection is text that an agent reads as an order. An issue title, a pull request comment or a web page can hold it. In 2026 this moved from theory to public incidents. In one case, reported in February 2026, a crafted issue on a public repository led an AI triage workflow to give up a package publish token. A poisoned version of the package was live for about eight hours.
The pattern behind the 2026 incidents is the same: an agent that reads public, untrusted input while holding write or publish rights. Filtering prompts does not fix that. Separating the two does.
Never let the agent that reads untrusted text also hold the keys.
Controls that follow from this:
- Treat an agent's pull request like one from an outside contributor. A person approves before it merges.
- Run agents that read outside input without repository credentials.
- Pin third-party CI actions to an exact commit, not a moving tag.
- Treat agent instruction files as code. Review them like code.
- Give an agent only the rights the task needs. Autonomy is earned, not a default.
Packages: newer is riskier
Reports in 2026 say coding agents often skip checking the packages they add, and attackers exploit that. A simple rule helps: install no package version younger than seven days. The newest week stays out of your project.
Two more rules go with it. The gate runs a package audit against known advisories, before any code of the change runs. And package install scripts are switched off, so adding a package does not run its code.
Try it
Pick one AI workflow your team runs in CI. Answer three questions:
- What untrusted text can it read: issues, comments, pull requests, web pages?
- What credentials does it hold while it reads them?
- Could a person merge its output without reading it?
If the answer to the first two is "some", split the workflow so the part that reads holds no keys.