When you point an AI coding agent at a hostile repo, whose settings does it obey?

Description and use

<p>AI coding agents make good security reviewers. They can read a repo the way a human reviewer would. But a security review means running an agent on code you do not trust, and that raises a question I had not thought about until I tested it: whose configuration does the agent obey, yours or the repo's?</p> <p>I work on <a href="https://github.com/secfoo-com/secfoo" rel="noopener noreferrer">secfoo</a>, an open-source (MIT) CLI that hands an agent such as Claude Code a security brief and a target. While verifying its Claude adapter, I tested exactly that.</p> <h2> The test </h2> <p>I built a

Problem

<p>AI coding agents make good security reviewers. They can read a repo the way a human reviewer would. But a security review means running an agent on code you do not trust, and that raises a question I had not thought about until I tested it: whose configuration does the agent obey, yours or the repo's?</p> <p>I work on <a href="https://github.com/secfoo-com/secfoo" rel="noopener noreferrer">secfoo</a>, an open-source (MIT) CLI that hands an agent such as Claude Code a security brief and a target. While verifying its Claude adapter, I tested exactly that.</p> <h2> The test </h2> <p>I built a

Outcome

<p>AI coding agents make good security reviewers. They can read a repo the way a human reviewer would. But a security review means running an agent on code you do not trust, and that raises a question I had not thought about until I tested it: whose configuration does the agent obey, yours or the repo's?</p> <p>I work on <a href="https://github.com/secfoo-com/secfoo" rel="noopener noreferrer">secfoo</a>, an open-source (MIT) CLI that hands an agent such as Claude Code a security brief and a target. While verifying its Claude adapter, I tested exactly that.</p> <h2> The test </h2> <p>I built a

Evidence

When you point an AI coding agent at a hostile repo, whose settings does it obey?

Source