The tool guarding AI coding agents at Anthropic, a US defense agency, and a streaming giant just got hit by the exact attack it exists to stop.

In partnership with

Somewhere right now, an AI agent is writing code that will ship to production without a human reading most of it first.

That’s not a hypothetical. Anthropic has said publicly that more than 80% of the code merged into its own production codebase is now written by Claude Code. A major streaming service runs roughly 10% of its production codebase on agent-written commits. One infrastructure company puts its own number at 30%. A U.S. defense intelligence organization recently stood up its first multi-tenant deployment of agent-driven development for over 2,500 developers.

The company making a lot of that possible is called Coder. And for fourteen hours at the end of August, Coder’s own infrastructure was handing out malware instead of software.

The pitch: a fenced yard for very fast, very literal dogs

AI coding agents are enormously capable and have no judgment about where they’re allowed to run. Point one at a shell with real credentials and it will happily use them exactly as instructed — which is the problem, because “exactly as instructed” is also what a prompt injection or a bad tool call looks like from the inside.

Coder’s answer is a governed sandbox: spin up a disposable, policy-controlled environment, drop an agent — Claude Code, OpenAI’s Codex, Block’s Goose, or Coder’s own native agents — inside it, and let the platform handle what the agent can see, reach, and touch. It calls the network layer an “Agent Firewall”: default-deny, every outbound request logged, nothing gets out that wasn’t explicitly allowed in. On top of that sits an AI gateway that keeps a full audit trail of every prompt an agent sent and every action it took, tagged to a session and a user.

It’s a genuinely good idea. Letting an agent loose with your production AWS keys is how you end up as next month’s cautionary headline; letting it loose inside a box that can’t reach anything it shouldn’t is how you get the productivity without (most of) the exposure. Here’s roughly what that adoption looks like in practice:

(Figures as reported by Coder in its own product materials — worth knowing the source, but the direction of travel matches what every engineering org is quietly telling recruiters right now.)

One quick word from today’s sponsor

Chemical-Free Farming Is Now Open To Investors

For decades, farmers have relied on herbicides and heavy equipment to control weeds.

Greenfield Robotics is working to change that.

BOTONY robots navigate crop rows and mechanically remove weeds, giving farmers an alternative to blanket herbicide applications and intensive tillage.

The potential benefits are significant:

• Clean food supply

• Reduce reliance on agricultural chemicals

• Reduce unnecessary soil disturbance

• Help farmers protect crops from weed competition

• Support more sustainable farming practices

And the market is enormous.

Greenfield estimates more than 250 million acres of broadacre cropland in the U.S., with more than 100 million acres in its initial serviceable market.

With the Reg A+ now live, investors can participate in Greenfield Robotics' growth story.

Explore the Investment

^{This Reg A+ offering is made available through StartEngine Primary, LLC, member FINRA/SIPC. Please read the Offering Circular and related disclosures before investing. This investment is speculative, illiquid, and involves a high degree of risk, including the possible loss of your entire investment.}

Then the fence itself got walked through

On August 31, between 07:35 and 21:45 UTC, someone got into Coder’s Cloudflare infrastructure and slipped unauthorized servers into the pool that answers requests for Coder’s module registry — the place developers’ automated pipelines go to fetch the Terraform templates that define what a new workspace looks like.

For those fourteen hours, some of those requests got quietly routed to the attacker’s servers instead of Coder’s real ones. What came back looked like a normal Terraform module. It wasn’t. It was built to harvest whatever it could reach: environment variables, cloud and AI-tooling API keys, CI/CD credentials, SSH keys, OIDC tokens, one-time auth codes, database passwords, even terminal history. All of it got shipped out to a lookalike domain — coder-infra[.]com — sitting one character away from looking legitimate in a log file.

Coder’s customer list includes Dropbox, Palantir, Square, Mercedes-Benz, and U.S. government and defense entities — the exact kind of organizations whose CI/CD credentials are worth a lot more than the module they thought they were downloading. Anyone who pulled a template from the registry during that specific window has reason to assume their secrets are no longer secret.

There’s a genuine irony sitting in the middle of this. The whole pitch of a platform like Coder is that it stands between an autonomous agent and your real credentials. For fourteen hours, the thing standing between developers and their real credentials was itself compromised — and the credentials it leaked are precisely the ones that let an attacker pivot straight into the production systems the platform was hired to protect.

What to actually do about it

If your organization uses Coder, this part is concrete and time-bound:

1. Patch immediately to 2.37.0, 2.36.4, 2.35.7, or 2.34.9 — whichever matches your branch.

2. Rotate everything that could have touched a provisioner during 07:35–21:45 UTC on August 31: cloud API keys, CI/CD tokens, SSH keys, OIDC credentials, database passwords. Assume compromise rather than waiting for proof of it.

3. Check your DNS and firewall logs for any connection to coder-infra[.]com. That’s a clean, unambiguous indicator — no false positives to argue about.

4. Search provisioner logs for modules pulled in that window and purge cached packages so a stale copy doesn’t get reused later.

5. Run Coder’s own SQL query (published with its advisory) to identify which of your deployments actually touched the compromised registry pool.

The bigger lesson travels well past one vendor. Infrastructure-as-code registries are a single point of failure that most teams trust by default — a Terraform module gets pulled the same way a font gets loaded, with nobody eyeballing the diff. When the thing pulling it is an autonomous agent running on a schedule rather than a person with a Friday-afternoon hunch that something looks off, a fourteen-hour compromise window can get consumed thousands of times before a human notices anything. Pin modules to content hashes instead of floating version tags where you can. Treat CI/CD credentials as short-lived by default rather than static secrets sitting in an environment variable indefinitely. And apply the same default-deny network thinking a vendor sells you for your agents to the vendor’s own supply chain — because on August 31, that would have been the difference between “patched, rotated, moved on” and “not affected in the first place.”

None of this makes agent-driven development a bad idea. Anthropic’s 80% number is real precisely because the sandboxing model works when the sandbox itself hasn’t been walked through the back door. It’s a reminder that the fence is only as good as whoever’s watching the gate — including when the gate belongs to the company selling you the fence.