How do you secure AI coding agents like Claude Code, Copilot, Cursor, Codex, and Muse Code?
One policy for Claude Code, Copilot, Cursor, Codex, and Muse Code — checked before each tool call through managed settings.
Read guideAI Security
Coding agent security guides
Policies, rollout, and limits for securing Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code.
What these guides cover
Coding agents run shell commands, read and write files, fetch URLs, and call MCP servers with the developer's credentials, on a laptop or in a vendor's cloud sandbox. None of that traffic passes through an AI gateway or a network proxy, and instructions in AGENTS.md or CLAUDE.md are read by the model rather than enforced. The enforcement point is the hook each agent fires before a tool call or prompt, installed by an administrator through managed settings or MDM so that a developer without administrator access can't remove it. A policy on that hook can deny destructive commands, reads of credential files, unreviewed MCP servers, disallowed models, and high-risk destinations. OpenTelemetry and the Claude Compliance API add visibility across the organization without enforcing.
Risks
- Destructive shell commands and writes to protected paths
- Credential and .env reads that leave the laptop
- Unreviewed MCP servers and malicious destinations
- Personal accounts and clients that never load the hooks
Control priorities
- Hook policies installed through managed settings or MDM
- One policy across Claude Code, Copilot, Cursor, Codex, and Muse Code
- MCP server, model, and destination allowlists
- Visibility through OpenTelemetry and the Claude Compliance API
Recommended reading order
Start with the coding agent security guide for the enforcement model and each vendor's limits. Then open the guide for the agent you deploy: Claude Code, GitHub Copilot, Cursor, OpenAI Codex, or Muse Code. Use the policy guides for destructive commands, secrets, MCP servers, and models, and read the fail-open guide before you rely on a hook for enforcement.
Guides in this collection
How do you secure Claude Code in the enterprise?
Hooks for every Claude Code tool call, prompt, and model switch — deployed through managed settings or MDM.
Read guideHow do you secure the GitHub Copilot CLI and cloud agent?
To secure GitHub Copilot's agents, install hooks that send each pending tool call to a policy service before the tool runs.
Read guideHow do you secure Cursor's agent?
Cursor runs hooks as commands, so a policy check needs a small wrapper script on preToolUse and beforeSubmitPrompt with failClosed set.
Read guideHow do you secure OpenAI Codex?
Codex runs hooks as commands, so a policy check is a wrapper script on PreToolUse, PermissionRequest, and UserPromptSubmit that exits 2 on any failure.
Read guideHow do you stop a coding agent running destructive commands?
To stop a coding agent running destructive commands, deny them at the hook that the agent fires before each tool call.
Read guideBest coding agent security tools in 2026
Shortlist coding agent security tools by where they enforce – native settings, hooks, endpoint agents, gateways, or code checks.
Read guideWhat is session tainting for AI agents?
Mark an agent session untrusted after a risky finding, and lock risky follow-up actions until a person reviews it.
Read guideHow do you stop a coding agent from using AWS credentials?
Block the AWS CLI, AWS API hosts, and AWS credential files in one policy, so a blocked route doesn't lead to another.
Read guideHow do you require human approval when Claude Code runs in auto mode?
Turn auto mode off in managed settings, or refuse risky tool calls in autonomous modes with a hook policy.
Read guideHow do you stop a coding agent reading .env files and credentials?
To stop a coding agent reading .env files and credentials, deny the read at the hook that the agent fires before each tool call.
Read guideHow do you restrict which MCP servers a coding agent can use?
To restrict which MCP servers a coding agent can use, check each MCP tool call against an allowlist at the hook that the agent fires before the call runs.
Read guideHow do you restrict which AI models developers can use in coding agents?
Keep developers on approved AI models with one hook policy.
Read guideHow do you block personal Claude, ChatGPT, Copilot, and Cursor accounts on work laptops?
Personal AI accounts are a common form of shadow AI.
Read guideAGENTS.md is not a security control
The model can ignore or be talked out of rules in AGENTS.md and CLAUDE.md.
Read guideDo coding agent hooks fail open?
Claude Code and Copilot hooks fail open, and the Codex and Cursor wrappers fail closed.
Read guide