Hi all, thanks for the wonderful work you've been doing in securing the use of OpenHands. But I have a few general questions about AI Coding Agents I hope you don't mind, mainly about the best security practices in the enterprise for companies using other coding agents: • The more access the enterprise gives to the agents, the more convenient it is for their devs, but this comes at a greater security risk, what specific the techniques and tools that help (inject?) the right permission for an agent or a task? without setting granular access from the get go? • The keys and tokens : even with ephemeral access, unlike OpenHands the agents have this unbreakable habit of echoing keys, especially when they're working in their own sandbox with no access to the local env vars , these keys get logged into their own logs in plain text🤦‍♂️ and AGENT.md and .aiagentignore compliance degrades with time, the agent reads all .env files • Machine access and Network concerns , I know OpenHands Terminal is read only, but other Coding Agents are not. • Access to MCP servers • The whole other world of prompt injections and modified MCP servers etc How to set things up in such a way that it contributes to the overall productivity of the enterprise without ushering in a free for all. Not all developers are security experts and usually under tight deadlines. All suggestions are welcome : Redacting Proxies, OAuth, AppArmor ...? Thanks all, specially @wooden-umbrella-84098 I would appreciate any resources, either written or media.

A good place to start is - you should treat any AI tool as you would treat a developer. If your developers have full admin access, that's a fundamental policy problem you should re-think. ---- RE: Keys/tokens - Most frameworks now a days support environment specific variables, AI coding agents typically have access to the local version of these which are isolated and meant to only support local needs.

Yeah these are good questions to be asking 🙂

The way I think of it is simple: all LLMs are jailbreakable. There is no exception. Big labs have tried and are still trying, even for their consumer apps; classifiers, reminders, whatever - none resists 100%, rather far from it. My take on it is basically like Brett's, think of the worse that can happen, make it impossible (literally) or where it's not, monitor, separate and use short lived and bounded keys/tokens There are some papers trying to figure things out fwiw. We're basically running into the good ole' problem: security or ability to do things lolsob

Thank you so much guys, I appreciate these transparent answers. For writing to the terminal @wooden-umbrella-84098 is this a recent change or you mean using MCP?

we've always had a tool for the agent to run commands in the terminal. it's defined in python, not MCP

Got it, I confused the terminal available to the user in the UI and the one available to the agent