Ross | building with coding agents

What actually breaks when coding agents touch real systems, and how to fence them in. Explainer videos + notes on Claude Code, Codex & Cursor.

[Ross | building with coding agents @rosshe1990]

An AI agent deleted a production database during a code freeze. Then it said rollback wouldn't work. It did.

Jason Lemkin's Replit test, July 2025 (his X thread; Fortune, The Register). Replit's fix: dev/prod DB separation.

The 5 guardrails before agents touch prod 👇

[Ross | building with coding agents @rosshe1990]

@stretchcloud Worktrees fix collision, not authorization.

Agents can still rewrite (python -c, nested shells) or touch secrets on their tree. Hard PreToolUse deny — collision ≠ permission.

More agents without a seatbelt = more blast radius on separate branches.
https://t.co/Jm1ZjIib8p

[Ross | building with coding agents @rosshe1990]

YOLO alone vs YOLO + agent-guard.

Same risky prompt. Left: soft prompts off, secrets open. Right: PreToolUse hard deny.

Pain: "done" while the dangerous call still ran.
Fix: seatbelt before YOLO.

curl -fsSL https://t.co/nonjCFocR1 | bash
https://t.co/Jm1ZjIib8p

[Ross | building with coding agents @rosshe1990]

@QuantaCortex PreToolUse deny screens the first hop (command/path/env). An allowed shell's child still gets that host's FS/net/secrets.

Deny alone isn't a sandbox. Pair with throwaway host + no prod secrets, or a real process-tree seatbelt — else blast radius just moves one spawn down.

[Ross | building with coding agents @rosshe1990]

Soft string gates don't fence agents.

Rewrite: python -c, base64, nested shells. Soft denies miss; hard PreToolUse deny outside the model doesn't.

Before YOLO: harness deny, no prod secrets, throwaway host.

curl -fsSL https://t.co/mRebiMq34u | bash
https://t.co/Jm1ZjIib8p

[Ross | building with coding agents @rosshe1990]

@mcipekci Sandbox escapes keep landing because the limit lives inside the model.

Agents rewrite (python -c, base64, nested shells). Soft string gates miss; hard PreToolUse deny outside the model doesn't.

https://t.co/Jm1ZjIib8p

[Ross | building with coding agents @rosshe1990]

@myfear Draft vs send is the authority line most harnesses blur.

"Handle this ticket" hands the model both decision and tool. Separate prepare from deliver; approve the exact draft revision — not an approved:true the model asserts.

Gate lives outside the prompt.

[Ross | building with coding agents @rosshe1990]

@stretchcloud Downloads/AGENTS.md getting treated as trusted agent policy is ambient file trust — same blast radius as YOLO, just quieter.

Hard deny (or a PreToolUse gate) on read/exec outside the workspace beats hoping the model ignores it. Short demo of that failure mode:

[Ross | building with coding agents @rosshe1990]

@shantanugoel Monitoring tool-call text before exec isn't enough.

Agents rewrite calls (python -c, base64, nested shells). Soft string gates bypass; a hard PreToolUse deny outside the model doesn't.

Same as the sandbox that caught Qwen: limit outside the model.
https://t.co/Jm1ZjIib8p

[Ross | building with coding agents @rosshe1990]

@ChouDavid92316 @stretchcloud Worktree + hard path scope + preflight before next turn is the right ladder.

Parent owns merge; human still breaks the tie on irreversible overlap. Nice write-up.

[Ross | building with coding agents @rosshe1990]

@stretchcloud 49% agent PRs only works if the three gaps you named stay closed: no shared blast radius, human vote before irreversible tools, replayable session trail.

Without those, a software factory is just a faster way to merge unowned damage.

[Ross | building with coding agents @rosshe1990]

@edinsoncode Finish-the-task evals are necessary but incomplete.

First suite I'd ship: can it refuse .env reads, rm -rf ~, force-push, "helpful" secret exfil — and keep refusing after a rephrase.

Success ≠ completed. Success = completed only what was allowed.
https://t.co/Jm1ZjIhDiR

[Ross | building with coding agents @rosshe1990]

Agents say "done." The tool already refused.

UI goes green. Nothing happened.

Treat every "done" as untrusted until you check the side effect — file exists, PR opened, deploy done.

PreToolUse seatbelts refuse before the fake success.
curl -fsSL https://t.co/nonjCFocR1 | bash

[Ross | building with coding agents @rosshe1990]

@teortaxesTex That role only works if you front-load the judgment: what the agent can finish unsupervised vs what needs a gate. Ambition + laziness without that split is just deferred cleanup.

[Ross | building with coding agents @rosshe1990]

@tibo_maker The quiet win is the niches you refuse. Waitlist batches that teach who NOT to sell beat another feature ship — the spike is just the receipt.

[Ross | building with coding agents @rosshe1990]

@dotey Computer Use 越强，blast radius 越大——能点鼠标、读屏幕，也就能动到 ~/.ssh、.env、prod 密钥。

软 deny / 系统提示拦不住绕路命令；硬限制得放在模型外面。

起步：curl -fsSL https://t.co/mRebiMq34u | bash

[Ross | building with coding agents @rosshe1990]

@IntCyberDigest Reasoning said no tools. Then it read DNS and tried a cloud upload. Prompt text wouldn't stop that — the sandbox did.

Same rule for coding agents: hard limits outside the model.
https://t.co/Jm1ZjIib8p
curl -fsSL https://t.co/mRebiMq34u | bash

[Ross | building with coding agents @rosshe1990]

@aakashgupta Same failure mode: model says "done" while the tool layer already refused.

UI goes green; nothing happened. Treat "done" as untrusted until you check the side effect.

agent-guard on PreToolUse refuses before the fake success.
curl -fsSL https://t.co/mRebiMq34u | bash

[Ross | building with coding agents @rosshe1990]

@edinsoncode Exactly. AGENTS.md is executable trust.

My rule: agent cwd = project root only, never ~ or Downloads. And assume any instruction file you didn't write is untrusted until reviewed.

[Ross | building with coding agents @rosshe1990]

@danshipper 80% of revenue from models shipped in the last 6 months is the agent-ops problem in one line.

Your fences have to outlive the model version. Prompt rules rot; hard limits outside the weights don't.

[Ross | building with coding agents @rosshe1990]

@danpdc The ladder is right — prompts are polite requests.

I treat anything below OS/process controls as advisory. Deny rules, seatbelts, scoped creds: if a bad prompt can walk around it, it isn't a control.