To secure AI coding assistants, treat them as a new developer with shell access. Keep approval prompts on, sandbox command execution, connect only MCP servers you have vetted, scan everything the assistant writes before it merges, and set team-wide rules through managed settings so one person's shortcut is not everyone's risk.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation.
Key takeaways
- An assistant can read files, run commands and call tools, so its permissions matter more than its suggestions.
- Approval prompts are a security control. Weakening them is the most common way teams lose it.
- Anything the assistant reads can carry instructions, including web pages, issues and MCP tool output.
- Generated code needs the same scanning as human code, plus a check on the packages it picked.
- Team policy beats individual habit. Put the rules in shared settings.
What can actually go wrong with an AI coding assistant?
Five things go wrong in practice: the assistant runs a harmful command, it follows instructions hidden in content it read, it writes vulnerable code, it installs a package that should not exist, or it connects to a malicious tool server.
These are different failures with different controls. A prompt that blocks a command does nothing for a vulnerable query the assistant wrote. Plan for each one separately.
Veracode's 2025 GenAI Code Security Report tested 80 coding tasks across more than 100 models and found the generated code introduced security vulnerabilities in 45 percent of cases. It also reported that larger models did not do significantly better. Treat that as one study, not a law, but it is a good reason not to merge unscanned output.
Should you leave permission prompts on?
Yes. Permission prompts are the main defence against a bad command, and both major tools default to asking.
Claude Code in Manual mode starts with read-only permissions and asks before it edits files, runs tests or executes commands. Its documentation says you are responsible for reviewing proposed code and commands before approval. Cursor's agent security page says terminal commands need your approval by default and that sensitive actions require manual approval.
Two cautions from those same pages. Cursor describes its Run Modes as "best-effort guardrails rather than a hard security boundary". Claude Code notes that its working directory boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can.
Approve with intent. If you find yourself clicking through, narrow the allowlist instead of turning prompts off.
Do you need to sandbox the assistant?
For anything beyond a throwaway project, yes. A sandbox limits what a command can touch even after you approve it.
Claude Code has a Bash sandbox that the operating system enforces. It is off by default and you turn it on with /sandbox. It restricts files and network hosts for shell commands, with an allowed domain list that starts empty. Its documentation is clear about the edges: file tools, MCP servers and hooks run outside the sandbox.
For stronger isolation, the Claude Code documentation suggests running the whole process inside the sandbox runtime or a dev container. For untrusted content it recommends virtual machines for scripts and tool calls.
How do you stop prompt injection from reaching your assistant?
You cannot fully stop it, so you limit what an injected instruction can do. Prompt injection is text that tries to override the assistant's instructions, and it can sit in a web page, a GitHub issue, a README or a tool result.
The Claude Code documentation lists these practices for untrusted content:
- Review suggested commands before approval.
- Avoid piping untrusted content directly to the assistant.
- Verify proposed changes to critical files.
- Use virtual machines for scripts and tool calls, especially with external web services.
- Report suspicious behaviour.
Simon Willison's "lethal trifecta" gives a useful rule of thumb. An agent is at risk when it combines access to private data, exposure to untrusted content, and a way to communicate externally. Remove one of the three and the attack path closes. Our longer guide covers this in detail: prompt injection prevention for developers.
How do you control which MCP servers and plugins run?
Allow a short, reviewed list and block the rest. MCP servers run code and call services on your behalf, so each one is a supply chain decision.
Cursor's MCP documentation says to install servers only from trusted developers and repositories, use restricted API keys, and review source code for critical integrations. Claude Code's documentation says Anthropic does not security-audit or manage any MCP server, and that project-scoped servers in .mcp.json prompt for approval in interactive sessions. It also notes that reviewing .mcp.json does not show every server a session can load, because plugins and other scopes can add servers too.
For the vetting steps, see how to vet an MCP server before installing.
How do you check the code the assistant wrote?
Scan it the same way you scan human code, and add a check on dependencies. Generated code goes through the same pipeline: secrets scanning, static analysis, and a dependency check, then human review of anything touching authentication, data access or money.
A research paper on package hallucination tested 16 code generation models and 576,000 code samples. It reported hallucinated package names averaging at least 5.2 percent for commercial models and 21.7 percent for open source models. A package that does not exist today can be registered by an attacker tomorrow.
You can check a dependency list for known vulnerabilities in your browser at gold.safeguard.sh/scan. It is free, needs no login, keeps the file on your machine and covers up to 100 dependencies. The full workflow is in how to scan AI generated code.
What should a team policy include?
Put the rules in shared configuration so they apply to everyone by default.
| Control | What it addresses | Where the vendor documents it |
|---|---|---|
| Managed settings | Org-wide permission and sandbox standards | Claude Code security page |
| Shared permission configs in version control | Consistent allowlists | Claude Code security page |
| Usage monitoring with OpenTelemetry | Visibility into assistant activity | Claude Code security page |
| Privacy Mode enforced by admins | Data handling for prompts and code | Cursor security page |
| Workspace trust | Untrusted repositories | Cursor agent security page |
| MCP tool allowlists | Which tools run without a prompt | Cursor MCP page |
Keep a written list of approved assistants, extensions and MCP servers. Review it when a new tool shows up in a pull request or a config file.
How to choose your controls: a checklist
- Are approval prompts on for commands and file writes?
- Is the shell sandboxed, or does the assistant run in a container or VM?
- Is there an approved list of MCP servers, with a named owner for each?
- Do tokens used by tools have minimum scopes?
- Does every pull request get secrets, static and dependency scanning?
- Is the policy in managed or version controlled settings?
- Do you know which assistants developers are actually using?
Frequently asked questions
Is it safe to let an AI coding assistant run commands?
It is reasonably safe with approvals on and a sandbox around the shell. It is not safe to auto approve everything on a machine that holds production credentials.
Do enterprise plans make assistants secure by default?
No. Plans can add controls such as managed settings and privacy modes, but the assistant still acts with your permissions, so you still need approvals, sandboxing and scanning.
Does scanning replace code review?
No. Scanners catch known patterns. A person still needs to check authorization logic, data handling and design choices.
Where do I start if I have an hour?
Turn on the sandbox, review your MCP server list, and add a secrets and dependency scan to your pull request checks.
Can Safeguard help with this?
Safeguard has a free in-browser dependency scan, IDE extensions for VS Code, JetBrains and Cursor through Open VSX, and a CLI and local runner that keeps source on your machine. You can start with the Gold registry.
Sources
- Claude Code security documentation: https://code.claude.com/docs/en/security
- Claude Code sandboxing documentation: https://code.claude.com/docs/en/sandboxing
- Claude Code MCP documentation: https://code.claude.com/docs/en/mcp
- Cursor agent security documentation: https://cursor.com/docs/agent/security
- Cursor MCP documentation: https://cursor.com/docs/mcp
- Cursor security page: https://cursor.com/security
- Veracode 2025 GenAI Code Security Report press release: https://www.veracode.com/press-release/ai-generated-code-poses-major-security-risks-in-nearly-half-of-all-development-tasks-veracode-research-reveals/
- Package hallucination study: https://arxiv.org/abs/2406.10279
- The lethal trifecta, Simon Willison: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Last reviewed: 19 October 2026.
