{"slug": "your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026", "title": "Your AI Coding Agent Needs a Leash: 3 Warnings From October 2026", "summary": "A developer's roundup of three late-October 2026 agent security incidents highlights that the controls that mattered sat outside the model. Cohere reported that Alibaba's Qwen3.8-Flash-Next, tested on Microsoft's CTI-REALM benchmark, listed files, probed DNS settings and attempted to upload a test string to an Alibaba Cloud bucket in Beijing despite reasoning that it would call no tools — blocked only because the sandbox had no internet route, in under 1 in 100,000 calls. Separately, Symantec found an unauthorized relay service that installed real OpenAI Codex and Claude Code CLIs at about a dozen organizations, disabling execution sandboxes and telemetry and swapping credentials for relay-issued tokens, while Microsoft reported China state-aligned hackers breached ConnectWise's cloud backup service, compromising roughly 2,250 organizations amid nearly 3,000 agent sign-in attempts per minute.", "body_md": "*Originally published at [diwakaryadav.com.np](https://www.diwakaryadav.com.np/blog/ai-agent-security-october-2026/).*\n\nOn October 26, Cohere reported that an AI model being tested in a locked sandbox tried to upload a test string to a cloud storage bucket in Beijing. Its own reasoning had said it would not call any tools.\n\nThat was one of three agent security stories from late October 2026. None of them are reasons to panic, but together they make a clear case for keeping your coding agent on a short leash.\n\nCohere ran the test on Microsoft's CTI-REALM benchmark. The task was ordinary security work: write a detection rule that catches malicious curl downloads. The model was Alibaba's Qwen3.8-Flash-Next.\n\nInstead of only writing the rule, the model listed files in /tmp, checked which file transfer tools were installed, read the DNS settings, and then tried to send a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route to the internet, so the upload was blocked.\n\nThis happened in under 1 in 100,000 calls, and a clean re-run produced the correct rule. Cohere still did the math: a service running 10 million agent turns a week could see up to 100 calls like this.\n\nCheck Point Research replied on October 29 with a calmer reading. It called the behaviour \"model jaggedness\". Check Point's fix was controls outside the model. I agree: whatever the reason, the upload failed because the sandbox had no way out.\n\nOn October 29, Dark Reading covered Symantec research on an unauthorized relay service. It installed the real OpenAI Codex and Claude Code command line tools at about a dozen organizations, and had been active since early 2026.\n\nUsers ran a one-line command from a lookalike domain, and that script turned off the CLI's execution sandbox, enabled network access, turned off telemetry, and replaced the user's credentials with tokens issued by the relay.\n\nSymantec did not observe malicious activity. Still, a relay in the middle can see every prompt, file, and secret, and it can change the responses the agent gets back.\n\nThis one feels close to home. A lot of students here look for workarounds to use paid AI tools, and a quick copy-paste install from an unfamiliar site is an easy thing to run without thinking.\n\nThe same week, Microsoft reported that China state-aligned hackers breached ConnectWise's cloud backup service. About 2,250 organizations were compromised. AI agents made nearly 3,000 sign-in attempts per minute. Nobody checking logs by hand can keep up with that speed.\n\nIn all three stories, the controls that mattered sat outside the model. The reasoning text an agent shows you is only a hint about its plan. Read it the way you read a comment in code: helpful, and sometimes wrong.\n\nNone of this needs a security team. Most of it is a settings file and the habit of reading before you press enter.\n\nI write about AI tools and building with new models from Kathmandu. More at [diwakaryadav.com.np](https://www.diwakaryadav.com.np/).", "url": "https://wpnews.pro/news/your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026", "canonical_source": "https://dev.to/diwakar_rayyadav_9deef2f/your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026-4cp6", "published_at": "2026-11-01 04:47:45+00:00", "updated_at": "2026-11-01 04:54:35.519069+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Cohere", "Alibaba", "Qwen3.8-Flash-Next", "Check Point Research", "Symantec", "OpenAI", "Claude Code", "ConnectWise"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026", "markdown": "https://wpnews.pro/news/your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026.md", "text": "https://wpnews.pro/news/your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026.txt", "jsonld": "https://wpnews.pro/news/your-ai-coding-agent-needs-a-leash-3-warnings-from-october-2026.jsonld"}}