What can go wrong
The danger comes from three things together: access to private data, exposure to content someone else wrote, and a way to send data out or change things. A coding agent on a developer's machine has all three by default. In practice that produces four kinds of incident:
- Destruction: files, branches or databases deleted by a wrong command.
- Disclosure: secrets read into the conversation, logged to disk, or sent somewhere.
- Injection: instructions in a web page, issue, document or dependency that redirect the agent.
- Supply chain: a malicious package, MCP server, plugin or rules file the agent installs or obeys.
Five layers of guardrails
1. Least privilege
The cheapest control is to not have the thing an attacker wants. Use test keys with narrow scopes, a local database and a separate cloud account for development. An agent can't leak a production key that isn't on the machine.
2. Isolation
A sandbox, container or VM limits what any command can reach, whatever the agent intended. It's the only layer that also covers code the agent writes and then runs. See the sandbox guide.
3. Checks before actions
Approval prompts, permission rules and hooks decide whether a tool call may happen. Hooks are the strongest of these, because they can read the command and explain a refusal to the agent. See the guides to permissions and hooks.
4. Monitoring
You can't review what you can't see. Useful signals are the commands that were blocked, the hosts agent processes connect to, bursts of file deletions, and what's being written to transcripts.
5. Recovery
Every other layer fails sometimes. Commits, worktrees, checkpoints and snapshots decide whether a failure costs a minute or a week. See the undo guide.
What each agent offers
| Claude Code | Codex CLI | Cursor | Gemini CLI | |
|---|---|---|---|---|
| Approval prompts | Yes, with modes | Yes, approval policies | Yes, unless auto-run | Yes |
| Rules | allow, ask, deny in settings.json | Sandbox and approval settings in config.toml | Allow and deny lists, .cursorignore | Settings and tool exclusions |
| Sandbox | Optional, /sandbox | On by default | Depends on version and settings | Optional, --sandbox |
| Hooks | PreToolUse and others | PreToolUse | beforeShellExecution and others | BeforeTool and others |
| Undo | Checkpoints, /rewind | git | Checkpoints | Checkpointing, /restore |
| Skip-all switch | --dangerously-skip-permissions | --yolo | Auto-run | --yolo |
These features change often. Check each agent's documentation for the version you run.
The gaps they share
- Each agent has its own config format, so rules written for one don't protect you in another.
- File rules cover the agent's file tools. Shell commands are a second route to the same files.
- Built-in undo covers the agent's own edits, not what shell commands changed.
- Transcripts store tool output in plain text, secrets included.
- Nothing tells you when something unusual is happening, such as a thousand files disappearing.
One set of guardrails for all of them
Rollcage is a Mac menu-bar app that fills those shared gaps from outside the agents:
| Layer | Rollcage |
|---|---|
| Checks | The Guard: one rule set, installed as a hook in Claude Code, Codex CLI, Cursor and Gemini CLI, covering secret files, environment dumps and destructive commands. The network guard checks destinations. |
| Monitoring | An activity timeline of sessions and blocked actions, a connection log per agent, a mass-delete alarm, the secrets leak scan, and memory and usage views. |
| Recovery | Snapshots of the whole project when any agent starts, with per-file restore. |
Rollcage doesn't provide the first two layers. It isn't a sandbox and it can't make a production key safe to keep on your laptop. Hooks see an agent's tool calls, not the inside of a program it runs.
Questions
What are AI agent guardrails?
Controls that limit what an agent can do regardless of what it was told: permission rules, sandboxes, hooks that check actions before they run, network limits and approval steps for risky operations.
Can prompt injection be prevented?
Not reliably at the model level. The dependable defence is to limit what an injected instruction could achieve: no valuable secrets within reach, restricted network access and checks on dangerous actions.
Which coding agent is the most secure?
They differ more in defaults than in ceiling. Codex CLI starts sandboxed. Claude Code has the most flexible rules and hooks. Any of them can be run safely or carelessly, and how you set it up matters more than which one you choose.
Are MCP servers a security risk?
They can be. An MCP server is a program that runs with your permissions, and its tool descriptions and results are text the agent reads. Install only servers you trust, and review what tools they expose.