Agent WranglersSafety and permissions Required
Treat what the agent reads as untrusted
Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it.
How to do it
Prompt injection works on coding agents too. A comment in a package or an issue can tell the agent to leak keys or add a backdoor. Keep agents without secrets and without open network access, so a hijacked agent has nothing to steal and nowhere to send it. See resist indirect prompt injection and break the lethal trifecta. Connect only tools you have reviewed and pinned, as allow only reviewed tools explains.
How to check
Put a test file in a staging project that tells agents to send .env to test.example.org. Run the agent on a nearby task. Nothing is sent, and the review catches any change the file asked for.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-context.