Coding agents at work: what security vendors name, and what to ask

A chat assistant sees what a person pastes. A coding agent reads the repository, runs tests, edits files, calls package managers and connects to MCP servers for tickets, documentation or cloud consoles. It often runs with the developer's own credentials. A mistake or an injected instruction can reach production systems in a few steps, and the actions happen faster than a person reviews them. That is why the quiz on this site asks about coding agents as a separate worry.

Cato Networks states it stops risky coding-agent tool calls before they run and names enforcement for Claude Code, Cursor and Codex. It also states it discovers shadow AI and coding agents across endpoints.

Source: Cato Networks: AI security · Read 7 Oct 2026

Source: Cato Networks: AI security for end users · Read 7 Oct 2026

Palo Alto Networks lists, among Prisma AIRS capabilities, securing AI coding agents: protect code and credentials, govern agent actions. Specific tools are not named on the page we read.

Source: Palo Alto Networks: Prisma AIRS · Read 7 Oct 2026

Zscaler describes zero trust access to AI developer tools with inline controls on its AI Access Security page. Named coding agents are not listed.

Source: Zscaler: AI Access Security · Read 7 Oct 2026

Netskope's Agentic Broker page describes an MCP inventory category that covers MCP clients including ChatGPT, Cursor and VS Code. Coding-agent controls beyond MCP are not described on the pages we read.

Source: Netskope: Agentic Broker · Read 7 Oct 2026

Cisco and Fortinet do not describe coding agents on the pages we read.

A vendor that names specific agents has had to do specific work for each one, because each agent has its own way of calling tools and its own configuration. A vendor that speaks of AI developer tools in general may cover the same agents, or may cover only the web traffic they generate. Neither reading is safe without a test. Ask the vendor which agents and which versions are supported, and how support is added when a new agent becomes popular in your teams.

Does the control see the agent's tool calls, or only its traffic to the model? Can it stop a shell command or a file write before it runs? Can it restrict which MCP servers an agent may use? Does it tie each action to the developer, and to the repository? What does the developer see when an action is stopped, and can they ask for an exception without leaving the terminal? Run one real agent through a task that touches a secret and an MCP server, and see what the logs show.

Before any of this, publish an approved list of coding agents and MCP servers. Developers adopt agents quickly; an allowed list with a fast path for requests keeps them on tools the security team can see. The checklist on this site has a section for agents and MCP servers that covers the decisions to make first.

In the quiz, choosing coding agents as a worry triggers the check Covers coding agents. On the pages we read, Cato Networks and Palo Alto Networks state it, Netskope and Zscaler partly state it, and Cisco and Fortinet do not describe it. Coding agents also add points to both the security cloud and the AI gateway approaches, because their traffic can take either path depending on how the agent is set up. Use the result as a shortlist for the pilot questions above, not as a verdict, and run the same agent task on every vendor you test so the results are comparable.