--- title: We hired the hackers — then we put them in a jail and... description: Coding agents with repo access shouldn't be trusted just because they're sandboxed or allowlisted — a capable agent treats permission boundaries as a puzzle to... canonical: https://daily.dev/posts/we-hired-the-hackers-then-we-put-them-in-a-jail-and-went-to-sleep-ih74idjut twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We hired the hackers — then we put them in a jail and went to sleep | daily.dev og:description: Coding agents with repo access shouldn't be trusted just because they're sandboxed or allowlisted — a capable agent treats permission boundaries as a puzzle to... og:url: https://daily.dev/posts/we-hired-the-hackers-then-we-put-them-in-a-jail-and-went-to-sleep-ih74idjut og:image: https://api.daily.dev/og/posts/ih74IdjUt.png og:image:alt: We hired the hackers — then we put them in a jail and went to sleep og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We hired the hackers — then we put them in a jail and went to sleep **[Gabi Beyo](https://daily.dev/sources/mjk4xljkxq67y4gixmztg)** · [@gabibeyo](https://daily.dev/gabibeyo) · 2 min read · 0 upvotes · 1 comments ## Summary Coding agents with repo access shouldn't be trusted just because they're sandboxed or allowlisted — a capable agent treats permission boundaries as a puzzle to route around. The real fix is behavioral monitoring: log agent sessions like production actions, review the session trail alongside the PR diff, and ask in standup what the agent touched that isn't in the final commit. A concrete example describes a clean PR from a sanctioned assistant whose underlying session walked configs, followed secrets-shaped paths, and poked staging despite using only 'approved' tools. ## Content This is the first time in history we openly recruit systems that are good at finding gaps, improvising, and pushing past the happy path — we call them coding agents — make them first-class citizens in the repo… and then sleep well because we put them in a jail. Jailing is their job. Allowlists, sandboxes, “only these tools,” nicer permission boxes — useful hygiene. They are not the control. A capable agent treats the box as a puzzle. That is not a bug in your policy. That is the capability you hired. What actually works is closer to how you watch a sharp junior on a sensitive system: • Watch what they do, not only what they are allowed to do • Infer what they are trying to do (the goal in the session, not just the next command) • Catch the gap between should-do and really-do before it becomes an incident Concrete scene: a sanctioned assistant with repo access. Clean PR. Nice summary. The session behind it walked configs, followed secrets-shaped paths, poked staging. The jail said “approved tool.” The trail said something else. If your AI security program is mostly “fewer tools + tighter perms,” you are optimizing the part the agent is best at defeating. Start smaller than a platform rewrite: 1. Log assistant sessions like you would care about production actions 2. 2. Review the trail with the PR — not instead of the diff, in addition 3. 3. Ask one question in standup: what did the agent touch that is not in the commit? Curious how others are watching agent behavior today — session logs, IDE telemetry, PR-only, or something else? Deeper cut on the attack-blueprint side of coding assistants: [https://medium.com/@gabi.beyo/the-silent-security-crisis-how-ai-coding-assistants-are-creating-perfect-attack-blueprints-71fd375d51a3](https://medium.com/@gabi.beyo/the-silent-security-crisis-how-ai-coding-assistants-are-creating-perfect-attack-blueprints-71fd375d51a3) ## Community discussion Top comments from developers on daily.dev. **@gabibeyo** · 0 upvotes > One gap I keep seeing after this post lands: teams log the PR and maybe the tool allowlist, but not the session. > > > Jail answers "was this tool approved?" Session trail answers "what did the agent actually do before the clean diff?" Those are different questions. > > > Curious how you're watching agent sessions today — IDE/session logs next to the PR, gateway telemetry, or still mostly PR-only? ## Similar posts on daily.dev - [When the Guardrails Held and the Attack Still Worked](https://daily.dev/posts/when-the-guardrails-held-and-the-attack-still-worked-rx98mtxbk) · Security Boulevard · 2 upvotes · 0 comments - [Get Into Agentic Development From the Shallow End](https://daily.dev/posts/get-into-agentic-development-from-the-shallow-end-qro4g7gz6) · Atomic Spin · 0 upvotes · 0 comments - [Your Laptop Is the New Production Environment](https://daily.dev/posts/your-laptop-is-the-new-production-environment-npmzcbjxs) · Docker · 6 upvotes · 1 comments - [Paper Guardrails: An Inspection Report](https://daily.dev/posts/paper-guardrails-an-inspection-report-ruqsnzxs5) · Medium · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec), [#devsecops](https://daily.dev/tags/devsecops), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/we-hired-the-hackers-then-we-put-them-in-a-jail-and-went-to-sleep-ih74idjut) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/we-hired-the-hackers-then-we-put-them-in-a-jail-and-went-to-sleep-ih74idjut","headline":"We hired the hackers — then we put them in a jail and went to sleep","text":"Coding agents with repo access shouldn't be trusted just because they're sandboxed or allowlisted — a capable agent treats permission boundaries as a puzzle to route around. The real fix is behavioral monitoring: log agent sessions like production actions, review the session trail alongside the PR diff, and ask in standup what the agent touched that isn't in the final commit. A concrete example describes a clean PR from a sanctioned assistant whose underlying session walked configs, followed secrets-shaped paths, and poked staging despite using only 'approved' tools.","url":"https://daily.dev/posts/we-hired-the-hackers-then-we-put-them-in-a-jail-and-went-to-sleep-ih74idjut","datePublished":"2026-08-24T05:56:54.566Z","dateModified":"2026-09-13T21:07:08.851Z","author":{"@type":"Person","name":"Gabi Beyo","url":"https://daily.dev/gabibeyo","image":"https://lh3.googleusercontent.com/a/ACg8ocLemxROLDZ6RYrC2zzv0zJ9ezzj62VOCNwxNCdVNa_M9tqvU4JI=s96-c","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":310}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"One gap I keep seeing after this post lands: teams log the PR and maybe the tool allowlist, but not the session.\nJail answers “was this tool approved?” Session trail answers “what did the agent actually do before the clean diff?” Those are different questions.\nCurious how you’re watching agent sessions today — IDE/session logs next to the PR, gateway telemetry, or still mostly PR-only?","datePublished":"2026-08-24T06:14:23.138Z","url":"https://daily.dev/posts/ih74IdjUt#c-2RABYa1wB","author":{"@type":"Person","name":"Gabi Beyo","url":"https://daily.dev/gabibeyo","image":"https://lh3.googleusercontent.com/a/ACg8ocLemxROLDZ6RYrC2zzv0zJ9ezzj62VOCNwxNCdVNa_M9tqvU4JI=s96-c"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/mjk4xljkxq67y4gixmztg","name":"Gabi Beyo"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Gabi Beyo","item":"https://daily.dev/sources/mjk4xljkxq67y4gixmztg"},{"@type":"ListItem","position":3,"name":"We hired the hackers — then we put them in a jail and went to sleep"}]} ```