The fix for risky agents is identity, not better prompts

The coding agent has the keys

The most widely used coding agent in professional work ships with defaults that assume the user will do the security work. Since October 2026, the Cursor agent can read files outside the workspace without asking, including sensitive credentials, and Workspace Trust, the control that would limit that access, is off by default. m:…0436

The guardrails the company offers are explicitly limited. Cursor's run modes are described by the company as best-effort guardrails rather than a hard security boundary. Privacy Mode prevents data training and ensures zero data retention with model providers, but it does not protect against prompt injection or malicious agent behavior. m:…0436

The attack path that has actually worked is the supply chain. Supply chain attacks, such as fake extensions and malicious npm packages, are the proven attack path for compromising Cursor users. A trojanized build of the Claude Code extension was served via Cursor's marketplace for 11 hours on October 29, 2026, and Cursor published 33 security advisories through July 2026. Its sandbox has been escaped at least eight ways. m:…0436

The fix, on the security firm's account, is enterprise control: enterprise plans allow security teams to force Workspace Trust and lock run mode policies, and cloud agents run each agent in its own Firecracker microVM. But the gaps are easy to miss. On Linux, if the MDM policy file is missing or contains invalid JSON, Cursor runs without policy restrictions. m:…0436

Stop holding keys at all

Reducto, a document-processing company, has drawn the sharper conclusion: the simplest defense is to stop holding long-lived keys in the first place. Its API now supports workload identity federation, letting customers replace long-lived API keys with short-lived tokens from existing identity providers. m:…8689

The mechanics are deliberately boring. Reducto access tokens expire in one hour or less, and its SDKs for Python and Node support automated token exchange and caching. It supports identity providers including GitHub Actions, Kubernetes, AWS, Azure, Google Cloud and Oracle Cloud, and supports X.509 and mTLS for workloads using client certificates. The company processes loan files, medical records, contracts and tax returns, and says it does not use long-lived API keys for its own internal AI model calls. m:…8689

The urgency is visible in the incident list Reducto cites: Anthropic reported that three AI labs attempted to distill Claude, attackers used 24,000 fraudulent accounts to run 16 million exchanges through proxy services, OpenCode experienced a breach where attackers accessed OpenAI, Anthropic and Google keys, and Railway advised users to rotate keys after a potential decryption of environment variables. API keys are bearer secrets that do not expire unless manually rotated. m:…8689

Verified identity becomes the product

The market is moving the same way. Summit Partners reports that Keyfactor announced its intent to acquire Cofide to bring verified identity to AI agents and cloud workloads, and that Socure announced a strategic growth investment and acquired the agentic operations platform Fravity. Summit warns that AI tools may produce inaccurate, misleading or incomplete responses, and notes that the use of third-party AI tools poses risks to proprietary data protection. m:…5236

What buyers should demand

The thread across all three is that the agent security debate has moved past prompts and policies written in documents. The question buyers now have to answer is which identity a piece of software presents when it acts, how long that identity lasts, and who can revoke it. Cursor's defaults show what happens when those questions are left to individual users. Reducto's answer is to make the credential expire within an hour. Keyfactor's acquisition says verified identity for agents is now a product category worth buying. m:…0436 m:…8689 m:…5236