--- title: Your Coding Agent Has Your AWS Keys and an Open Internet... description: Coding agents face a fundamental tension: setup needs network access to install dependencies, but executing untrusted model-generated code alongside... canonical: https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your Coding Agent Has Your AWS Keys and an Open Internet Connection | daily.dev og:description: Coding agents face a fundamental tension: setup needs network access to install dependencies, but executing untrusted model-generated code alongside... og:url: https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89 og:image: https://api.daily.dev/og/posts/Pdad4WK89.png og:image:alt: Your Coding Agent Has Your AWS Keys and an Open Internet Connection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your Coding Agent Has Your AWS Keys and an Open Internet Connection **[Medium](https://daily.dev/sources/medium_js)** · 9 min read · 0 upvotes · 0 comments ## Summary Coding agents face a fundamental tension: setup needs network access to install dependencies, but executing untrusted model-generated code alongside credentials and network access creates an exfiltration risk. Tensorlake's sandboxes address this with a dynamic network policy that can change mid-run without restarting the sandbox, swapping in about 127 milliseconds. The piece measures this in practice, showing that after locking down, an agent can still import already-installed packages and access cloned repos, but is blocked from exfiltrating secrets via outbound requests. It also details how the allow_out, deny_out, and allow_internet_access flags interact, including a DNS resolution gotcha when internet access is disabled. The piece is sponsored by Tensorlake and closes by framing egress control as one part of a broader security stack including fresh per-task sandboxes and unprivileged users. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I prevent a coding agent from leaking AWS credentials over the network after it runs model-generated code? Use a sandbox that supports changing network policy on a live, running instance rather than only at creation time. Tensorlake's sandboxes let you allow internet access during dependency setup, then call sb.update with allow_internet_access=False and an empty allow_out list before executing untrusted model-written code, sealing off egress in about 127 milliseconds without rebuilding the environment. _daily.dev surfaces practical security patterns like this for teams hardening their AI agent pipelines._ ### Does disabling allow_internet_access still let me reach a specific allowlisted host by IP address in Tensorlake sandboxes? Yes, but only by IP, not by hostname. Setting allow_internet_access=False alongside an allow_out entry like 1.1.1.1 still permits traffic to that address, but DNS resolution is also blocked as part of egress, so requesting the same host by hostname fails while the same request by IP returns normally. Pin addresses or resolve them before locking down. _Teams configuring network allowlists for agent sandboxes can track these gotchas via daily.dev._ ### What is the lethal trifecta risk for AI coding agents with network access and credentials? It refers to an agent having simultaneous access to private data, untrusted content, and an open network connection, which lets a prompt injection hidden in a README, issue comment, or scraped page instruct the agent to read local credentials and exfiltrate them via an outbound request, since the agent treats that instruction as just another tool call. _Developers assessing agent security risks can follow ongoing coverage of this on daily.dev._ ## Similar posts on daily.dev - [Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk](https://daily.dev/posts/practical-security-guidance-for-sandboxing-agentic-workflows-and-managing-execution-risk-msv2ndpel) · NVIDIA Developer · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your Coding Agent Has Your AWS Keys and an Open Internet Connection","url":"https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89"},"datePublished":"2026-08-30T21:22:31.766Z","dateModified":"2026-08-30T21:23:07.493Z","description":"Coding agents face a fundamental tension: setup needs network access to install dependencies, but executing untrusted model-generated code alongside...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b3bfe0c39aa37474b990e0e189a3ebbe?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b3bfe0c39aa37474b990e0e189a3ebbe?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,prompt-injection","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Your Coding Agent Has Your AWS Keys and an Open Internet Connection"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-coding-agent-has-your-aws-keys-and-an-open-internet-connection-pdad4wk89#faq","mainEntity":[{"@type":"Question","name":"How can I prevent a coding agent from leaking AWS credentials over the network after it runs model-generated code?","acceptedAnswer":{"@type":"Answer","text":"Use a sandbox that supports changing network policy on a live, running instance rather than only at creation time. Tensorlake's sandboxes let you allow internet access during dependency setup, then call sb.update with allow_internet_access=False and an empty allow_out list before executing untrusted model-written code, sealing off egress in about 127 milliseconds without rebuilding the environment. daily.dev surfaces practical security patterns like this for teams hardening their AI agent pipelines."}},{"@type":"Question","name":"Does disabling allow_internet_access still let me reach a specific allowlisted host by IP address in Tensorlake sandboxes?","acceptedAnswer":{"@type":"Answer","text":"Yes, but only by IP, not by hostname. Setting allow_internet_access=False alongside an allow_out entry like 1.1.1.1 still permits traffic to that address, but DNS resolution is also blocked as part of egress, so requesting the same host by hostname fails while the same request by IP returns normally. Pin addresses or resolve them before locking down. Teams configuring network allowlists for agent sandboxes can track these gotchas via daily.dev."}},{"@type":"Question","name":"What is the lethal trifecta risk for AI coding agents with network access and credentials?","acceptedAnswer":{"@type":"Answer","text":"It refers to an agent having simultaneous access to private data, untrusted content, and an open network connection, which lets a prompt injection hidden in a README, issue comment, or scraped page instruct the agent to read local credentials and exfiltrate them via an outbound request, since the agent treats that instruction as just another tool call. Developers assessing agent security risks can follow ongoing coverage of this on daily.dev."}}]} ```