I've watched a coding agent wander out of its project folder and start reading other client repos on the same laptop. It wasn't doing anything malicious. It was trying to be helpful. But some of those repos had production credentials in them, and they all got rotated that afternoon.

Most discussion about coding agents is about which model to use. Much less of it covers where the agent runs, and that's where most of the risk is.

What an agent on your host can reach

Run Claude Code directly on your machine and it runs as you. Whatever your user account can read, it can read too, including:

SSH keys in ~/.ssh

Cloud credentials in ~/.aws , ~/.config/gcloud and similar

Every .env file in every project on the disk

Every other repo you've cloned, including ones for other clients

That last one is what caught me out. Nobody worries about the agent reading the repo it's working in.…