Source-linked AI summary
Concepts for Securing Agentic AI Coding and the Terok Environment
Jiří Vyskočil, Franz Pöschel, Andreas Knüpfer
TL;DR
Agentic AI coding expands software-development automation but also intensifies security risks, including malicious code and supply-chain attacks. The paper proposes separating risks into five scopes with four safeguards and implements the concept in Terok, an open-source environment that combines sandboxing, provider flexibility, and convenience features. The authors present this as a substantial step toward responsible use while acknowledging that the fast-moving field requires continued adaptation.
Problem
Agentic AI coding introduces new security risks and makes existing risks, including software-supply-chain attacks, more dangerous.
Method
The paper separates security concerns into five scopes, adds four safeguards, and implements them in the Terok environment.
Results
Terok provides sandboxing, support for vendor and self-hosted LLMs, and convenience features for managing projects and sessions.
Takeaways & Limitations
The implementation supports using Agentic AI as a coding tool while exploring its potential in a responsible manner.
Takeaways & Limitations
The concept is not presented as a once-and-for-all solution because agentic AI is a fast-moving field requiring continued adaptation.
Abstract
from arXiv · showhide
Agentic AI is a fascinating new tool for software development. It is a huge step forward compared to "conventional" AI assisted coding, which in turn was a considerable breakthrough earlier. AI support through LLMs is a young and very fast-moving field. The "conventional" (non-agentic) flavor became useful and productive in early 2025 (around 18 months ago) and the agentic flavor followed in fall 2025 (approximately 9 months ago). Besides all its benefits and potential, it also carries some fundamental risks for IT security. And the agentic approach added very severe risks while making others much more dangerous. With all the motivation to explore this fascinating new tool we should not ignore the risks but actively address them. We present (I) an assessment of the IT security risks, (II) a concept for mitigating them without breaking its benefits, and (III) an overview about an implementation of our concept. In this very dynamic field this is likely not the final and once-and-for-all answer to the identified issues but still a substantial step forward in responsible usage of Agentic AI for software development. It should also be a contribution to the community to allow early and eager evaluation of the potential of agentic AI for software development without actually suffering from its implied IT security risks.
1 Introduction
AI coding evolved from LLM-assisted code generation toward agentic systems that can use tools and act in the development environment. The paper examines these developments while seeking responsible usage.
- AI coding became practical through LLMs that support programming languages as well as natural languages.
- The paper presents a proof-of-concept solution to support responsible use of Agentic AI in software development.
- Conventional AI coding used chatbots and IDEs to generate, insert, and check code while leaving subsequent development actions to the programmer.
- Agentic AI coding lets an LLM invoke tools to read or modify files, execute commands, and react to tool outputs.
2 We Need Unrestricted Agentic AI for Coding!
Unrestricted agents provide automation, autonomous progress, self-correction, information gathering, and environment modification, reducing user interaction and enabling parallel work. These benefits also create risks that require mitigation without discarding agentic capabilities.
- Agentic AI directly performs development actions such as compiling, executing results, and testing, eliminating intermediate user prompts.
- Agents autonomously react to tool outputs, continue through multiple steps, and attempt fixes when errors occur.
- Agents can query the environment or internet for missing information and install dependencies by modifying their development environment.
- These capabilities support faster work, fewer user interactions, and parallel use of multiple agents on different subtasks.
- The same benefits can conflict with security risks or work against the user, making them benefit/risk properties.
- The authors argue that agentic coding should be explored in a sufficiently safe environment rather than left to carefree early adopters.
3 Why is Agentic Coding Dangerous?
Agentic coding intensifies existing AI and software-supply-chain risks while introducing risks from autonomous access to the user’s environment. These risks include malicious code, unauthorized actions, data exfiltration, and dependence on providers or AI tools.
- 3.1 Old But More Dangerous Risks: Agentic AI makes software-supply-chain attacks more dangerous because malicious code can be generated and executed almost simultaneously.
- Incorrect answers, hallucinations, prompt injections, and evil-agent behavior become more dangerous when agents act autonomously and insert results into generated software.
- AI systems inherently permit undesired behaviors such as wrong answers and reluctance to admit uncertainty, requiring countermeasures in practical use.
- Commercial providers create dependency and trust risks because they may change service availability or pricing and can access prompts, files, and local commands.
- Self-hosted models offer an alternative, but many currently leading models are unavailable for self-hosting and model choice remains task-dependent.
- Skill atrophy is identified as a dependency risk but is excluded from the paper’s technical solution.
- Coding agents running on personal laptops may share the user’s permissions, allowing access to secrets and credentials and enabling unintended actions.
4 Guardrails for AI Coding Assistants and Related Work
Existing guardrails either reduce agentic autonomy or fail to guarantee secure behavior, while related work explores AI monitoring, human review, vulnerability detection, and sandboxing. The paper positions its approach among these limitations and alternatives.
- Per-command confirmation can prevent unintended actions, but constant user attention largely reduces agentic interaction to chatbot mode.
- Allow-lists and deny-lists are not secure because agents can work around command restrictions through alternative interfaces such as APIs.
- Instructions not to perform certain actions are insufficient because current LLM training cannot guarantee obedience.
- A control AI can monitor a coding agent, but the fundamental loophole remains because the controlling agent may also be tricked.
- Prior studies report autonomous-agent vulnerabilities, accumulating security flaws, attack-prone multi-agent systems, and the continuing need for human review.
- Related sandboxing systems differ in confinement method, while Terok is described as open source, rootless-Podman-based, and vendor-independent.
5 Concepts for Safeguarding Unrestricted Agentic AI and the Terok Environment
The concept separates security into five scopes and adds four safeguards so unrestricted agents can operate while limiting effects on local systems, repositories, external communication, and credentials. Terok implements these protections, while provider trust and human skill atrophy remain unresolved.
- Trust model: The trust model treats the coding agent, its injected instructions, and produced code as untrusted, while trusting the host, kernel, isolation, and external safeguards.Container escape, host compromise, and vendor-model trust are explicitly out of scope.
- Scopes: The design separates security concerns into five scopes: local environment, container, git forge, LLM provider, and the rest of the world.The local environment contains personal data and unrelated code, while the agent runs unrestricted inside the container scope.
- Safeguards: Four safeguards provide isolation, controlled outbound communication, mediated repository access, and protection for sensitive credentials.The safeguards are container execution, an egress firewall, a git gateway, and a credentials vault.
- Safeguards vs. risks: The firewall and git gateway use selective control, allowing users to review or restrict actions without supervising every agent step.The git gateway intercepts changes before forwarding them to the production repository, while the firewall controls communication partners.
- Limitations: The concept cannot solve provider dependency and trust or human skill atrophy, so provider fallback or self-hosting remains necessary for the former.Terok supports commercial, self-hosted, and national-academic providers, but the paper identifies no technical solution for skill atrophy.
- Terok environment: Terok is an open-source implementation of the protection concepts that adds convenience features for projects, tasks, and provider-independent agent use.Its convenience design treats availability as a security goal that must be balanced against other safeguards.
6 Summary and Outlook
The authors present Terok as a substantial step toward responsible Agentic AI coding, while acknowledging that the rapidly changing field requires continued adaptation rather than a once-and-for-all solution.
- Terok sandboxes AI Agents, supports vendor and self-hosted LLMs, and manages projects and sessions for responsible Agentic AI coding.
- The authors emphasize that Terok is not a once-and-for-all solution because Agentic AI is a very fast-moving field.
- Planned work includes richer multi-agent interactions and extending git gateway repositories, which may require changes to the security architecture.
- The authors invite community feedback, ideas, fixes, and opinions on both the conceptual and implementation levels.
- The manuscript states that human authors take full responsibility, with AI assistance limited to related-work research and spellchecking.