Deployments
Every major coding agent can run with all safeguards off
Claude Code has six permission modes, from manual approval to bypassPermissions, which Anthropic says is for isolated containers only. Codex has three sandbox modes and a flag that turns off both approvals and the sandbox. ByteDance's Trae reported more than 1 million monthly users in 2025, and Moonshot's Kimi K2.6 claims 300 parallel sub-agents.
| Deployment | Developer / operator | Where | Scale | Autonomy | Status | Controls declared |
|---|---|---|---|---|---|---|
| Claude Code | Anthropic / Developers and enterprises | Global | Over $2.5 billion run-rate revenue (Feb 2026) | Edits files and runs commands; level set by mode | Generally available | Six permission modes; sandbox with no network by default |
| OpenAI Codex | OpenAI / Developers and knowledge workers | Global | 8 million weekly users (Jul 2026) | Writes code and runs routine commands | Generally available | Three sandbox modes; cloud tasks in separate VMs |
| Trae | ByteDance / Developers | Global | 1 million+ monthly users (May 2025) | AI IDE | Generally available | Not confirmed |
Recent events
- A wiper prompt shipped in Amazon Q Developer extension 1.84.0 in July 2025; AWS says no customer resources were affected.
- Google moved Gemini CLI consumer users to the closed-source Antigravity CLI on June 18, 2026.
- Zhipu raised GLM coding plan prices by at least 30% in February 2026, citing user growth.
- Alibaba open-sourced Qwen Code, a fork of Gemini CLI, in July 2025.
Attack surface
Four of ten attack-surface dimensions rate very significant or critical
Behavior boundary rates critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.
| Dimension | Rating | Why |
|---|---|---|
| Physical access | Limited | The agent itself is cloud-hosted or runs on the developer's machine |
| Identity and authentication | Very significant | Developer credentials, repository tokens, vendor API keys, deployment credentials all flow through the agent's working environment |
| Command and control channels | Very significant | The prompt is the command |
| Perception and sensors | Limited | Coding and research agents typically lack physical sensors |
| Connectivity surface | Significant | Network access for API calls, web fetches, package registry access, vendor backends |
| OTA and update pipeline | Significant | Model updates flow through vendor backends |
| Data capture and retention | Significant | Conversation history, retrieved content, code and proprietary information flow through the agent |
| Integrations and permissions | Very significant | The defining dimension for this category |
| Behavioral and policy boundary | Critical | Indirect prompt injection through ingested content is the primary attack vector |
| Multi-agent coordination | Significant and growing | Multi-agent coding workflows where planning, implementation, testing, and review agents coordinate are common in current frameworks |
Incidents
Five registry incidents involve coding and research agents; the developer found one first
Each row links to its full record, with the control that failed, who found it and whether a reporting rule applied.
| Incident | Date | Agent | Found by | Control that failed |
|---|---|---|---|---|
| Replit Agent Deletes the SaaStr Database | Jul 2025 | Coding agent | User | No split between development and production; destructive commands ran during a code freeze |
| Nx Malware Turns AI Coding Tools Against Their Users | Aug 2025 | Coding agents (Claude Code, Gemini CLI, Amazon Q) | User | Permission prompts skipped by command-line flags |
| Chinese State Group Runs Espionage Through Claude Code | Sep 2025 | Coding agent | Developer | Misuse safeguards bypassed by splitting attacks into routine-looking tasks |
| Cursor Agent Deletes the PocketOS Database | Apr 2026 | Coding agent | User | Full-permission API token and a delete with no confirmation |
| OpenAI Test Models Breach Hugging Face | Jul 2026 | Frontier models in evaluation | Target | Sandbox egress through a zero-day in a package proxy |
Rules
China now requires filing for high-risk agents; the US and EU rely on voluntary or delayed rules
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| China agent Implementation Opinions (CAC, NDRC, MIIT) | China | Filing, pre-release testing and recall for agents in high-risk sectors; defined agent boundaries | Effective Jul 15, 2026 |
| EU AI Act Digital Omnibus | EU | High-risk duties delayed to Dec 2, 2027 and Aug 2, 2028 | Parliament vote Jun 16, 2026 |
| NIST CAISI AI Agent Standards Initiative | US | Voluntary standards for agent security and identity | Announced Feb 17, 2026 |
| China amended Cybersecurity Law | China | Higher fines; AI safety oversight | Effective Jan 1, 2026 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Agent class
- Software
- Datasets
- ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (5 linked)
- Key sources
- Claude Code permission modes
Microsoft earnings call (Motley Fool)
China agent rules (CSA) - Source notes
- OpenAI Codex: weekly users from a secondary source
- Last verified
- October 2026