The Lethal Trifecta Is Already on Your Laptops — Michael Patterson, Coder

Summary

Michael Patterson explains the “lethal trifecta” of risks created when an AI agent has all three of the following:

1. Access to private data, such as files, credentials, code, or databases.
2. Exposure to untrusted content that may contain malicious or misleading instructions.
3. The ability to communicate externally, including sending data to or retrieving content from the internet.

An agent running on a developer’s laptop may have all three capabilities. Patterson argues that this creates risks such as leaking confidential information, deleting data, or taking unintended actions. One way to exploit an agent’s access is prompt injection: malicious instructions embedded in sources the agent reads, such as support tickets, error messages, CI/CD logs, or documentation. Related risks include context poisoning and privilege escalation.

Three Proposed Security Safeguards

Patterson outlines three architectural controls for deploying agents more safely:

• Isolated cloud development environments: Run agents in remote, controlled environments rather than on personal laptops. This limits access to local files and credentials and makes it easier to provide a prepared, consistent development setup.
• A model proxy: Route agent traffic through an intermediary that can log requests and, where appropriate, remove sensitive information before it reaches an LLM provider.
• An agent firewall: Monitor and block unauthorized commands or network destinations, such as commands that delete repositories or databases.

Patterson emphasizes that agent security should follow established practices: limit permissions, use narrowly scoped credentials, control network access, and maintain visibility into agent activity.

Organizational Considerations

Companies adopting agents may face several challenges:

• Security approval, DevOps support, and clear use cases are often needed before a formal rollout.
• When official tools are unavailable, employees may use personal AI subscriptions on work devices, creating shadow AI that the company cannot readily monitor.
• Security and platform teams need useful observability without overwhelming staff with alerts and causing notification fatigue.
• Experienced engineers may be concerned about technical debt, code quality, security vulnerabilities, and the effort required to review AI-generated changes.
• Companies should plan their architecture and safeguards rather than rushing deployment.

Coder is presented as a provider of secure, configurable remote development environments. Patterson says these environments can be deployed across different infrastructures, are open source and model-independent, and can be self-hosted. They can also reduce setup friction by providing agents and developers with a ready-to-use environment.

Guides, Demonstrations, and Takeaways

• Security guide: Isolate agents, restrict data and network access, route model traffic through a proxy, and block unauthorized actions with an agent firewall.
• Demo: No demonstration was given during the talk; attendees were directed to the Coder booth.
• Main takeaway: Agents are powerful, but organizations should first establish controls and visibility over what they can access and do.

Main Speaker and Source

Michael Patterson, lead solutions engineer at Coder.