Coding Agent

A coding agent pairs a language model with an agent harness, the software around the model that supplies its tools and its loop. It differs from code completion in that it takes actions, not just suggestions. That is what OWASP calls agency, “the ability to call functions or interface with other systems via extensions (sometimes referred to as tools, skills or plugins by different vendors) to undertake actions in response to a prompt.” Its Top 10 for LLM Applications lists Excessive Agency (LLM06:2025), with three root causes, “excessive functionality; excessive permissions; excessive autonomy.” Common controls include least-privilege access, authorization enforced in downstream systems rather than by the LLM, and human approval of high-impact actions, such as review of changes before they are merged.

Security

A coding agent also changes where code and data go. Compilers, linters, and traditional code completion run on the developer’s own machine. A coding agent built on a cloud-hosted model sends its working context to the model provider. Anthropic’s documentation for Claude Code says that “to interact with the LLM, Claude Code sends data over the network,” including “all user prompts and model outputs,” and that the session’s context window holds “conversation history, file contents, command outputs,” among other things. Whatever the agent reads or runs can therefore leave the organization, including a .env file, a credentials file, or the output of a query against a database of customer records. OWASP’s LLM02:2025 Sensitive Information Disclosure lists “security credentials,” “confidential business data,” and “health records” among the information at risk.

Regulated data makes this a legal question as well as a technical one. A HIPAA covered entity that uses a cloud-hosted coding agent on code, logs, or incident data containing patient identifiers discloses protected health information to the model provider. HIPAA permits that only if the covered entity first “obtains satisfactory assurance that the business associate will appropriately safeguard the information,” documented “through a written contract or other written agreement or arrangement” (45 CFR 164.502(e)), commonly called a business associate agreement. Without one in place, an inadvertent use of a coding agent can become an impermissible disclosure. A model running on hardware the covered entity owns and operates may be different, since the data is not sent to an outside provider.

A cloud-hosted coding agent therefore puts the model provider inside the threat boundary of every repository and system the agent can reach, a boundary that local developer tools did not cross. Controls include limiting which files and commands the agent may access, keeping secrets out of what it can read, reviewing the provider’s data retention terms, and using a locally hosted model where data must not leave. This is an open area, and this entry will be expanded as Rietta publishes more on coding agent security.

Examples

Examples as of October 2026 include Anthropic’s Claude Code, which its documentation describes as “an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools”; OpenAI’s Codex CLI, “a coding agent from OpenAI that runs locally on your computer,” released under the Apache 2.0 license; OpenCode, which calls itself “the open source AI coding agent” and is released under the MIT License; and GitHub Copilot cloud agent, called Copilot coding agent until April 2026.

History

Yang et al. described SWE-agent, a language model agent that edits a repository and runs tests to resolve software issues, in May 2024. GitHub announced Copilot coding agent in public preview on May 19, 2025.

Sources

• LLM06:2025 Excessive Agency, OWASP Top 10 for LLM Applications. Retrieved October 7, 2026.
• Claude Code data usage, Anthropic. Retrieved October 21, 2026.
• Claude Code glossary: Context window, Anthropic. Retrieved October 21, 2026.
• LLM02:2025 Sensitive Information Disclosure, OWASP Top 10 for LLM Applications. Retrieved October 21, 2026.
• 45 CFR 164.502, Uses and disclosures of protected health information: General rules, Legal Information Institute, Cornell Law School. Retrieved October 21, 2026.
• Claude Code overview, Anthropic. Retrieved October 21, 2026.
• Codex CLI, OpenAI, GitHub repository. Retrieved October 21, 2026.
• OpenCode, OpenCode. Retrieved October 21, 2026.
• Research, plan, and code with Copilot cloud agent, GitHub Changelog, April 1, 2026. Retrieved October 21, 2026.
• SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering, Yang et al., 2024. Retrieved October 7, 2026.
• GitHub Copilot coding agent in public preview, GitHub Changelog, May 19, 2025. Retrieved October 7, 2026.