“We are particularly worried about agents that software developers are starting to use, because they are often granted considerable authority and access to far-ranging tools, opening up immense security vulnerabilities.”
Our reading, the sentence that was checked:
The authors are particularly worried about agents that software developers are starting to use, because these agents are often given considerable authority and access to far-ranging tools, which opens up immense security vulnerabilities.
Assessment: Supported Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, LLMs + Coding Agents = Security Nightmare, paragraph 7.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-llms-coding-agents-security-nightmare-b75733-a1
We recorded 12 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2025-08-17. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Causal claim
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
Conditions
- agents that software developers are starting to use (scope, stated by the speaker)
- often granted considerable authority and access to far-ranging tools (qualifier, stated by the speaker)
From the speaker
- agents that software developers are starting to use
- often granted considerable authority and access to far-ranging tools
- opening up immense security vulnerabilities
Our interpretation
- The factual claim concerns coding agents available by the post, not the authors' personal feeling of worry.
- Considerable authority means capabilities such as persistent file changes, shell execution, or access to developer data.
- Often is read as a recurring feature of ordinary configurations across mainstream products, not a measured majority of installations.
- Immense security vulnerabilities means serious consequences such as unauthorized command execution or credential exposure.
Counts as supported if: Primary configuration evidence and exploit demonstrations across mainstream coding tools connect their granted capabilities to serious unauthorized actions.
Counts as contradicted if: Representative evidence shows that ordinary configurations lack the asserted capabilities or reliably prevent their misuse, or that the demonstrated harms do not depend on those capabilities.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Does the evidence support the cause?
Outcome: Supported
The dated evidence matches what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
Original reports demonstrate the mechanism in mainstream coding tools: file and command authority let injected instructions produce unauthorized execution and data exposure. That supports the qualitative causal warning. Default restrictions, unsuccessful attacks against other tools, and patches show substantial variation. Support therefore depends on reading often as recurring ordinary product configurations, not as an established population frequency.
Limitations
- The frequency of broad permissions in actual installations remains unmeasured.
- The specific Copilot and Gemini CLI flaws cited were reported fixed before publication.
- Controlled demonstrations establish exploitable capability, not widespread victimization.
Evidence (4 items)
Supports the claim: Embrace The Red — Johann Rehberger,
Remote Code Execution
Why it matters here: The researcher reported that Copilot could persistently edit workspace files without approval, then demonstrated injected instructions changing its approval configuration and executing commands. June 29 is the documented disclosure date by which the exploit existed.
- Publisher
- Embrace The Red — Johann Rehberger
- Kind of source
- Demonstration
- Describes events of
- Public from
Supports the claim: Tracebit,
arbitrary code execution
Why it matters here: The demonstrated Gemini CLI chain combined injected repository text, shell access, an approved innocuous command, and faulty command validation to exfiltrate environment variables in its default unsandboxed mode. The report also says this specific attack failed against tested alternatives and was fixed in Gemini CLI before the post.
- Publisher
- Tracebit
- Kind of source
- Demonstration
- Describes events of
- Public from
Context only: GitHub,
limited internet
Why it matters here: A mainstream cloud coding agent had default network restrictions, qualifying any suggestion that broad authority always means unrestricted access. This is a different configuration from the local VS Code exploit.
- Where
- Opening paragraph
- Publisher
- GitHub
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Context only: Embrace The Red — Johann Rehberger,
now fixed
Why it matters here: The researcher reported remediation before Marcus's post. The exploit establishes the causal risk in that design, but cannot establish that patched installations retained this particular vulnerability.
- Publisher
- Embrace The Red — Johann Rehberger
- Kind of source
- Demonstration
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, LLMs + Coding Agents = Security Nightmare
We are particularly worried about agents that software developers are starting to use, because they are often granted considerable authority and access to far-ranging tools, opening up immense security vulnerabilities.
- Where
- paragraph 7
- Published
- 2025-08-17
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-llms-coding-agents-security-nightmare-b75733-a1: Current. Outcome: Supported. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-llms-coding-agents-security-nightmare-b75733-a1.