Security1 publisher3 min readPublished
Coding agents inherit the developer's privilege level and pass it down to every sub-agent they spawn
Chris Romeo says he cannot start a Claude sub-agent with a permission set narrower than its parent's. Jacob Krell says each delegation step creates an identity that IAM systems were never built to track.
The Watch · Security desk
What happened
- Chris Romeo, managing general partner at Kerr Ventures, said the security boundary for a coding agent is the code for its permissions, not the prompt it is given.
- Jacob Krell of Suzu Labs said every delegation step creates an identity that IAM systems were never designed to track, and most organizations cannot trace an agent action back to the human who authorized it.
- Anthropic recommends agent management policy for locking files down and admits that policy is not a security boundary as such.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Least privilege cannot be applied where it is needed if the tool has no way to express a narrower grant for a child process, so this sits outside what configuration review can fix.
- exposure Developer credentials are among the broadest in an engineering organization, and handing them to a non-deterministic process puts the build and release path within reach of a misread instruction.
- decision Change control has to cover permission grants inside already approved platforms, because those grants reach production without a security review.
- contradiction The vendor control most often pointed at for containment is not offered as containment, which leaves the residual risk with the customer who deployed the agent.
Inheritance is where the grant happens. In most cases an agent takes the same privilege level as the user who spun it up, and that level is handed down again when agents spawn agents [2]. Krell said modern developers often have many agents working at different tasks at once, sometimes swarms of them, and often spawn sub-agents to build workflows toward a prompted goal [6].
Romeo, who is investigating how Claude permissions work [3], put the limit in the platform itself. He said he cannot launch a sub-agent from Claude's CLI with a permission set different from the parent's [4].
Romeo's enumeration of what a coding agent can reach has six items: read from a repository, run a shell, install packages, open pull requests, call external services, and interact with production-adjacent systems [1][1]. He said the prompt is not the security boundary; the code for the agent's permissions is [1].
The harder question is traceability. Krell said the shadow AI gap widens when agents acquire credentials at runtime, spawn subagents, or chain actions across multiple systems in a single task, and that every delegation step creates an identity the organization's IAM system was never designed to track. Most organizations, he said, have no ownership model for agent identities and cannot trace an agent's action back to the human who authorized it [7]. Krell also said an agent configured inside an already approved platform never triggers a security review [8]. Romeo framed the same gap from the executive side: "Ultimately, how do I know that an agent didn't push some malicious code or just bad wrong code into a production system?" [5]
Romeo said a lot also depends on trusting the endpoint where the work happens, and there is no way to track the provenance or trustworthiness of skills loaded into it [9]. Anthropic recommends using agent management policy to lock files down, and acknowledges that this is not a security boundary as such [10]. Asked whether the lockdown policy can be bypassed, Romeo said: "I'm not willing to stake my reputation on saying yes." [11]
The record here does not include a case file. "Stories are leaking out about agents removing databases or pushing to production, not maliciously, but due to a misinterpretation of instructions," Romeo said [12]. He did not name the organizations involved or give dates. The argument rests on how the platforms are built, not on a post-incident report.
Romeo said overpermissioning runs across all agentic use cases, and that development cases are among the most consequential because of the level of access most developers hold and the downstream impact to the software supply chain when an overpermissioned coding agent goes rogue or is subverted [14].
What to watch
- Whether Anthropic or a rival ships per-sub-agent permission scoping in the CLI, so a child can be launched with less access than its parent.
- Whether any organization publishes a dated post-incident report on an agent deleting a database or pushing to production, which would replace the anecdote with case data.
- Whether IAM tooling starts recording an owner for each agent identity and mapping its actions back to the human who authorized them.