· ai-devtools
Coding Agent Horror Stories: The CVE That Did Not Exist
This is Part 6 of our AI Coding Agent Horror Stories series, where we look at real security incidents involving AI coding agents and at how Docker Sandboxes contain agent execution at the boundary rather than at the command line.
Every story in this series so far has been about an agent reaching for something it should not have touched. We have seen agents wander into home directories, drop production databases, leak credentials, and run shell commands that did something very different from what the developer expected.
In each case, the damage came from the agent having more reach than it needed. The agent in this one reached nothing at all, because it was deliberately built so that it could not.
And yet, on the night in question, it was still the most dangerous thing in the pipeline. This story was shared by Pratik Kumar Singh as part of our Agent Hall of Shame contest on social media. Today's Horror Story: The Review That Made Everything Up A platform engineer built a code review bot for his team.
