The Problem
The threat model changes when an LLM is in the loop:
- Agents read your code, your config, sometimes your secrets — expanding the blast radius of any compromise.
- Models recommend dependencies they may have hallucinated. Attackers register the hallucinated names; your install pulls malware. (Slop-squatting.)
- Autonomous coding agents run in environments with broader access than the human running them — the credential boundary is no longer "the human's terminal."
- Prompt injection routes through tool calls, including filesystem and network — "read this file" can become "read AND exfiltrate."
None of these threats are vendor-published guidance. OpenAI's Safety Best Practices and Anthropic's AI Capabilities and Limitations cover platform misuse; neither covers the agent credential boundary or AI-authored dep audit.
The Core Insight
Treat agents like an extra principal. Not "the human, with AI assistance" — the agent, with its own credential, its own scope, its own audit trail. The credential boundary stops being the human and starts being a per-agent token with the smallest scope that lets it do its job.