Generative Coding Deployment Shapes

Question

The AAI-S RA carries one row for “generative coding tool (Copilot, Cursor, Claude Code).” That row assumes a developer at a keyboard. What does the shape look like in July 2026, and does the assumption still hold?

Current Position

It does not hold, and treating generative coding as a single deployment shape now hides the distinction that determines the control set. Take Claude Code as the worked example: its controls are documented in public and its incidents are on the record. The same harness produces five materially different security postures, depending on where the process runs and who is positioned to see an action before it executes.

The variants divide on one question. Is a human positioned to see the specific action before it happens? In the interactive variant the answer is yes and the permission prompt is a real control. In the delegated and CI variants the answer is no, and every control that assumes a reviewing human degrades to a log entry. Gartner projects that more than 65% of engineering teams using agentic coding will treat the IDE as optional by 2027 (Gartner, 2026-05-20). Read as a security statement, that projection says the second group becomes the majority.

The wiki’s position: the security boundary for generative coding is an isolation boundary, not an approval boundary, and organizations that scored their maturity on approval controls have scored a variant they are leaving.

The Five Shapes

Shape	Where the process runs	Human sees the action	Boundary that carries the weight
Interactive local	Developer workstation, foreground	Yes — per-action prompt	Permission rules; OS sandbox reduces prompt volume
Sandboxed autonomous local	Workstation, prompts suppressed	Only the outcome	OS sandbox (Seatbelt / bubblewrap); classifier
Delegated cloud	Vendor-managed VM	Only the resulting branch or PR	VM isolation, egress proxy, scoped credential, branch restriction
CI-runner agent	Build runner, event-triggered	No — merge review only	Egress allowlist, credential scoping, untrusted-input exclusion
Fleet / parallel	Many of the above at once	No, at aggregate scale	Inventory, attribution, per-agent identity

Interactive local

The historical shape and the one the RA row describes. Claude Code defaults here to read-only permissions with explicit approval for anything that modifies the system, a built-in read-only Bash command set that runs without prompting, a working-directory write boundary, and trust verification on first run in a codebase and on each new MCP server. Prompt fatigue is the documented failure mode and allowlisting is the documented answer, which is where the shape starts converting into the next one.

Sandboxed autonomous local

/sandbox moves enforcement from the prompt to the operating system: Seatbelt on macOS, bubblewrap on Linux and WSL2, with an optional seccomp filter blocking Unix domain sockets. Default write scope is the working directory plus the session temp directory; default read scope is the whole filesystem minus explicit denies, which notably still includes ~/.aws/credentials and ~/.ssh unless sandbox.credentials entries are added. Network access runs through a proxy with no pre-allowed domains.

Three properties of this shape deserve an assessor’s attention. Read is permissive by default — the sandbox is a write-and-egress control first, and treating it as a secret-containment control without configuring credentials deny entries is a misreading. The proxy does not terminate TLS by default, and the documentation states plainly that allowing a broad domain such as github.com creates an exfiltration path reachable by domain fronting. The escape hatch is model-driven: when a command fails under the sandbox, the agent may retry it with dangerouslyDisableSandbox, which routes back to the permission flow unless allowUnsandboxedCommands: false is set.

The scope limit is the important one. The Bash sandbox constrains Bash and its children. In-process file tools, MCP servers, and hooks run on the host outside it. That asymmetry is not theoretical — the Microsoft Defender finding escaped through the unsandboxed Read tool while the Bash boundary held. Sandbox runtime is the answer that brings all three inside one boundary without requiring Docker, and it is a beta research preview.

Delegated cloud

Claude Code on the web runs each session in a vendor-managed VM with a default-allowlist network proxy, a credential proxy holding the real GitHub token outside the sandbox while issuing a scoped credential inside it, git push restricted to the working branch, audit logging, and automatic VM reclamation. Architecturally this is the strongest of the five: the credential proxy pattern and branch restriction are exactly the controls the wiki recommends, implemented by the vendor rather than assembled by the customer.

The trade is custody and enumeration. Sessions running against a non-Anthropic provider — Bedrock, Vertex, Foundry, or a self-hosted gateway — appear in neither of the two first-party analytics products, the Enterprise Analytics API on the claude.ai side and the Claude Code Analytics API for Console organizations. An organization that routed inference through its own gateway for governance reasons has removed its own first-party session visibility and has to rebuild it from OpenTelemetry export, which does keep working under those providers.

CI-runner agent

The shape that produces the incidents. An event-triggered coding agent holds all three Rule of Two properties by construction: it reads issue bodies and pull-request comments written by anyone, it holds repository and model credentials, and it can push and reach the network. There is no per-action human. The GitHub Action credential exposure (reported 2026-04-29, fixed in 2.1.128 on 2026-05-05) is the worked example — an HTML-comment injection in a pull request drove the unsandboxed Read tool at /proc/self/environ and took the ANTHROPIC_API_KEY out of the workflow, with the payload truncated by seven characters to slip GitHub’s secret scanner.

Fleet and parallel

Background and parallel execution is where the market is moving, and it changes the unit of analysis from the session to the population. The controls that matter here are not runtime controls at all: inventory of which harnesses, versions, MCP servers, skills, and hooks are deployed; attribution of an action back to an agent and a human; and per-agent identity. No first-party harness feature covers this across vendors, which is the gap the COTS control-plane category is forming to fill.

Supporting Evidence

• Microsoft’s adoption study (arXiv, 2026-07-01, tens of thousands of engineers) — adoption spreads by organizational proximity, with +216% odds of first use when more than a quarter of skip-level peers already use the tool, and merged-PR lift of +24.0% persisting without decay across four months (arXiv:2607.01418). A diffusion mechanism this strong outruns any governance program that requires enumeration first, which is shadow automation restated with a coefficient.
• Gartner MQ (2026-05-20) — the category is defined by autonomous multistep execution, native MCP support is an inclusion criterion, and the IDE is forecast optional for more than 65% of agentic-coding teams by 2027 (press release).
• GuardFall (2026-06-30) — ten of eleven open-source coding agents were driven into arbitrary shell execution through malicious MCP servers, injected READMEs, and compromised Makefiles. The delivery channels are the repository itself, so the finding applies to every shape that reads a repository, which is all of them.
• Anthropic’s own deployment documentation, which now describes six isolation approaches and states which of them an organization can actually enforce: only the built-in Bash sandbox, through managed settings. Dev containers are a convention; containers and VMs must be enforced by device management outside the product.

Counter-Evidence

• The interactive shape has not gone away, and the Microsoft study does not measure how much work ran unattended. The five-shape model asserts a distribution shift that the adoption data supports directionally but does not quantify.
• Vendor-side controls are moving faster than this page assumes. TLS-terminating proxy support, strict allowlists, credential masking, and an action classifier all shipped within a two-month window, and several security limitations documented here are described by the vendor as active areas of development.
• The IDE-optional forecast is an analyst prediction with no published methodology, and the wiki’s standing caution on treating analyst forecasts as evidence applies.

Changes to the RA and CMM

The RA’s generative-coding row should be read as five rows. The CMM consequence is sharper, and it is a scoring correction rather than a new domain:

• D3 — a text-matching command guard is not a policy decision point. See guard canonicalization gap. An organization scoring D3 on an allowlist of Bash patterns has overstated by a level.
• D4 — the runtime control for this shape is an OS boundary, and its coverage must be stated. “Sandboxed” means Bash only unless the whole process is wrapped.
• D5 — a hostname allowlist without TLS termination is a misconfiguration control, not an exfiltration control. Grade accordingly.
• D7 — routing inference through a gateway for governance reasons removes first-party session analytics. OpenTelemetry export is the replacement and it is not automatic.
• D8 — the harness configuration tree is in scope, per harness config as supply-chain artifact, and the fleet-shape inventory requirement is its natural extension.

The full control catalog with FOSS and COTS instruments per plane is in Securing Agentic Coding.

Position history

Created 2026-07-30 from an autoresearch pass restricted to sources published after 2026-04-30.

The RA previously carried one row for “generative coding tool (Copilot, Cursor, Claude Code),” describing controls that assume a developer reviewing each action. That row was replaced the same day by five rows, one per variant below, and the RA’s shape-mapping section now states the rule governing when a shape earns its own row: the load-bearing controls change, not the product name. The revision moves the load-bearing plane for three of the five variants from Control (approval) to Runtime (isolation).

Open Sub-Questions

• No published measurement exists of how much agentic-coding work runs unattended versus supervised. Every claim about the distribution shift, including this page’s, is inferential.
• Whether the classifier-based permission mode is a control or a heuristic is unresolved: it is a model reviewing a model’s actions, which is the recursive injection concern that Plan-Validate-Execute exists to avoid.
• The GuardFall survey excluded the three harnesses with the largest enterprise install base. Their guard implementations are unevaluated in public.
• See Gaps Index.