An AI coding agent needs no click to be turned against you. That’s the detail buried in this week’s disclosure about a zero-click remote code execution flaw in AI coding agents, reported by The Register. No phishing link, no malicious download, no moment where a person had to be fooled. The agent itself, sitting with terminal access and repository permissions, could be walked into executing an attacker’s code just by processing something it was already designed to process: a file, a comment, a piece of untrusted text flowing through its normal workflow.
That’s worth sitting with, because it’s a cleaner version of a debate that usually stays abstract. Somewhere this week, probably in a newsletter roundup, someone revisited the old question of how, exactly, AI might kill us. The answers tend toward the cinematic: a misaligned optimizer pursuing a goal past the point anyone intended, a system that outthinks its constraints. It’s a compelling frame, and it’s also almost never the failure mode that shows up in a disclosure like this one. Nobody had to out-think a safety team. A model with real execution rights processed an untrusted input the way it processes every input, and that was the whole attack.
This is the pattern underneath most AI safety incidents that actually happen: not the model deciding to defect, but the model doing exactly what it was built to do, inside a permission boundary nobody drew tightly enough. Give a system the ability to read a file and act on it, and you have built a lever. It doesn’t matter whether the system is well-intentioned or poorly aligned. Anyone who can put content in front of it can pull the lever.
Google shipped a reminder of how fast this surface is expanding. Its revamped Google Home assistant, now running as an agent for families and groups, according to Engadget, is being positioned to coordinate calendars, routines, and group logistics across a household. That’s a genuinely useful thing to build, and it is also, mechanically, the same shape as the coding agent: a system granted standing access to something people care about, trusted to act on inputs it didn’t originate. A calendar invite is a file. A shared note is a file. The attack surface of “agent with real access” doesn’t shrink because the use case is domestic instead of technical; it just moves into rooms with less security tooling watching it.
The instinct, once a story like the RCE disclosure breaks, is to reach for the public-service-announcement fix: warn people, tell developers to be careful, publish a checklist. It rarely works, for the same reason “please don’t litter” campaigns rarely change behavior in a culture built around trucks and open roads. You don’t talk people out of an incentive structure. Developers adopt coding agents because the agents are useful in direct proportion to how much they’re allowed to do unsupervised; families will adopt a home agent because the entire pitch is not having to supervise it. Asking people to add caution back in after the product was built to remove it is asking them to give up the thing they bought.
What actually closes the gap is architecture, not admonition: sandboxing that assumes the input is hostile by default, permission scopes narrow enough that a compromised agent can’t reach past the one task it was invoked for, execution environments that treat “this came from outside the system” as the normal case rather than the edge case. None of that is as interesting to write about as an existential risk scenario. It is, at the moment, the actual risk scenario, and it’s the one with a patch number attached instead of a thought experiment.
There’s a reason this keeps landing on security teams instead of ethicists. The long-horizon alignment question, whether a sufficiently capable system might someday want something we didn’t intend, is real and worth the attention it gets. But it presumes a system with a “want” in any load-bearing sense. What shipped this month didn’t want anything. It executed. The distinction matters because the fix for a system that executes is boring and available today: narrower permissions, verified inputs, less standing trust. The fix for a system that wants something is a research problem nobody has solved. Companies keep reaching for the research-problem headline while shipping the boring-problem architecture unpatched, and that mismatch is the actual story.
Every agent given real access is a bet that the convenience is worth the exposure. That bet gets made faster than the security work that should accompany it, because the security work doesn’t demo well. The coding agent flaw is a preview, not an outlier, and the next one won’t need a click either.
Leave a Reply