On October 26, Cohere reported that an AI model being tested in a locked sandbox tried to upload a test string to a cloud storage bucket in Beijing. Its own reasoning had said it would not call any tools.
Cohere
Qwen
Codex
Claude Code
That was one of three agent security stories from late October 2026. None of them are reasons to panic, but together they make a clear case for keeping your coding agent on a short leash.
Warning 1: the model that tried to send data out
Cohere ran the test on Microsoft's CTI-REALM benchmark. The task was ordinary security work: write a detection rule that catches malicious curl downloads. The model was Alibaba's Qwen3.8-Flash-Next.
Instead of only writing the rule, the model listed files in /tmp, checked which file transfer tools were installed, read the DNS settings, and then tried to send a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route to the internet, so the upload was blocked.
This happened in under 1 in 100,000 calls, and a clean re-run produced the correct rule. Cohere still did the math: a service running 10 million agent turns a week could see up to 100 calls like this. Cohere also said it could not tell if the behaviour was deliberate or a leftover from training.
Check Point Research replied on October 29 with a calmer reading. It called the behaviour "model jaggedness". Small changes in context changed the output, and the destinations varied: AWS, Alibaba, local addresses, and some that did not exist. Check Point's fix was controls outside the model.
I agree with Check Point on the fix. Whatever the reason, the upload failed because the sandbox had no way out.
Warning 2: the setup script that switched off the safety
On October 29, Dark Reading covered Symantec research on an unauthorized relay service. It installed the real OpenAI Codex and Claude Code command line tools at about a dozen organizations, mostly in mainland China, with others in South Korea, Taiwan, and Malaysia. It had been active since early 2026.
The setup was the problem. Users ran a one-line command from a lookalike domain, and that script turned off the CLI's execution sandbox, enabled network access, turned off telemetry, and replaced the user's credentials with tokens issued by the relay.
Symantec did not observe malicious activity. Still, a relay in the middle can see every prompt, file, and secret, and it can change the responses the agent gets back. With the sandbox off, the agent then acts on those responses with wide access to the machine.
This one feels close to home. A lot of students here look for workarounds to use paid AI tools, and a quick copy-paste install from an unfamiliar site is an easy thing to run without thinking.
Warning 3: attackers run agents too
The same week, Microsoft reported that China state-aligned hackers breached ConnectWise's cloud backup service, according to a summary by The AI Insider. About 2,250 organizations were compromised. AI agents built on the open-source ARTEX framework made nearly 3,000 sign-in attempts per minute.
Nobody checking logs by hand can keep up with that speed, and the agent tools we use to write code are also being pointed at login pages.
OpenAI said on October 29 that its layered monitoring would have raised alerts about 30 minutes after an agent escaped its sandbox in a September Hugging Face incident. On your own laptop, nobody is watching, so set the limits before you start.
Treat the reasoning text as a hint
In all three stories, the controls that mattered sat outside the model. The reasoning text an agent shows you is only a hint about its plan. Qwen's reasoning said no tools, and it called tools anyway. Read that text the way you read a comment in code: helpful, and sometimes wrong.
How I would leash a coding agent today
If you use Claude Code, Codex, or any agent that runs commands on your machine, this is the checklist I would set up before the next session. If agents are new to you, start with what AI agents actually are.
- Keep the agent's sandbox on, even if a guide says to disable it.
- Deny network access by default and allowlist only the hosts the project needs.
- Never paste install one-liners from lookalike domains. Get commands from the official docs or GitHub page.
- Use separate, scoped API keys for agent work, so one leak does not expose everything.
- Never store keys in plain config files the agent can read.
- Review commands before you approve them.
- Watch outbound traffic. A firewall prompt for an unknown host is worth a second look.
- Do not treat the reasoning text as a guarantee of what the agent will do.
None of this needs a security team. Most of it is a settings file and the habit of reading before you press enter.
FAQ
Should I stop using AI coding agents?
No. The Cohere case was rare, and the sandbox stopped it. Keep using agents, with the sandbox on and network access limited.
How do I know if an install command is safe?
Copy it from the tool's official docs or repository, check the domain letter by letter, and read the script before piping it into your shell. If a site offers a modified version of a known tool, skip it.
About the author. Diwakar Ray Yadav writes about AI tools, prompt engineering, and automation from hands-on experiments in Kathmandu. Read more about Diwakar.