AI coding tools delete files. Set the guardrails yourself

The most common security complaint about AI coding tools is not that they write bad code. It is that they delete things. A new academic study of developer discussions found that unauthorized file operations account for 43.1% of the security issues developers report about LLM-native IDEs — and the researchers put the blame on how the tools are built, not on the models running inside them.

What actually happened

Mostafijur Rahman Akhond, Md Afif Al Mamun, Gias Uddin and Song Wang collected 1.1 million posts from 29 subreddits, filtered to 446 posts, and coded more than 6,000 comments discussing Claude Code, Cursor, GitHub Copilot, OpenAI Codex and Replit. The paper, "Impossible to hide secret …": Uncovering Security and Privacy Issues in LLM-native IDEs, is accepted at ASE 2026.

The security breakdown, as reported by The Register:

• 43.1% unauthorized file operations, with the biggest sub-category at 28.3%: agents removing directories or files without permission
• 23.9% operational safety problems that reached production services
• 18.2% unsafe generated code
• 16.5% tools ignoring stated instructions and permission settings

On privacy, 45.9% of complaints were about unclear data collection and 23.7% about the tool reaching data it should not have.

The conclusion is the useful part. The authors write that most of these problems come from system-level design choices — file access scope, unchecked autonomous actions, default permissions — not from the underlying LLM. Developers in the threads were routinely building their own sandboxes because the shipped defaults did not hold.

Why it matters for your business

We run coding agents daily. This matches what we see: the model is rarely the failure. The harness is. An agent that can rm -rf your working directory is not a smarter agent than one that cannot — it is the same model with a wider blast radius, because someone shipped permissive defaults to reduce friction in a demo.

Treat the agent like a contractor with a keycard. What doors does the card open? A coding agent needs a repo checkout, a package manager, and a test runner. It does not need your .env, your SSH keys, your production database URL, or write access outside the project directory. Most setups grant all four by accident, because the agent inherits the shell of the person who launched it.

The fix is boring and it works: run agents in a container or a disposable worktree, keep secrets out of the filesystem the agent can read, require approval for anything that touches infrastructure, and keep the whole session under version control so you can diff what actually changed. That last one turns "the agent deleted something" from an incident into a git checkout.

The paper's recommendation to vendors is secure defaults. Ours to you is simpler: do not wait for them.

Sources: arXiv 2607.26390, The Register.