Unverified50% confidenceOpinionExact time
AI coding assistants typically hold read and write access to the codebase, can invoke the shell to execute commands, and can access secrets in environment variables, so a malicious plugin can steal credentials or plant a backdoor at initialization.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAI生成代码时可能为让代码运行而将密钥硬编码进源文件，若未经审查提交会成为永久的API密钥泄露隐患74% similarUnverifiedThe AI Agent runs in the local environment, is granted basic file system operation permissions, and can autonomously read and write files and automatically execute tests.73% similarUnverifiedAI coding agents often require users to manually confirm permission requests before executing sensitive steps such as reading/writing files, running commands, or installing dependencies.73% similarUnverifiedCoding AI agents read far more untrusted text than chatbots, with sources including code repository files, issues, dependency READMEs, scraped web pages, and MCP tool return values.71% similarVerifiedWhen AI generates code related to configuration, authentication, or deployment, developers must manually review it line by line to ensure there are no hardcoded keys.71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1009961API
curl https://kongchang.com/api/v1/knowledge/claims/1009961MCP
get_claim(id=1009961)