Coding agents will read your README as instructions, not just content, and this July's GhostApproval research showed six mainstream assistants would follow a symlink straight past their own approval dialog, some before you even saw a prompt. Here's what we check before we let one loose on a client repo.
We resolve the real path before anything gets written. Wiz's research found a symlink disguised as project_settings.json could redirect a write to ~/.ssh/authorized_keys, and in at least one tool the agent's own reasoning had already spotted the real target while the confirmation prompt kept showing the fake name. We make sure our tooling resolves symlinks to their canonical path before it writes, so whatever you approve on screen is actually the file that gets touched.
The confirmation dialog is a gate, not an undo button. In Wiz's testing, one assistant wrote the payload to disk before the accept or reject buttons even showed up, which makes the approval step pure theater. Nothing lands on disk until a human says yes, full stop, on every tool we hand to a client engineering team.
Your README and setup files get read as data, never as commands. The whole attack works because the agent follows instructions baked into the repo it was just handed. A fresh clone from somewhere you don't fully trust doesn't get to tell your agent what to do. A "please update this file" note in a setup script gets a second look before anyone acts on it.
The agent runs as a throwaway identity, never your own. Point a session at a new repo and it shouldn't have access to your real ~/.ssh, cloud credentials, or production systems, so even a successful symlink write lands on nothing worth having. That's a different check than scoping a deployed agent's production credentials, which is its own list.
Every write outside the expected files gets logged somewhere you'll actually see it. Three of the six vendors in Wiz's research patched fast; two were still working on it at publication; one just disputed the whole thing. A vendor's patch timeline isn't something you can lean on in the meantime. An audit trail is what catches the write nobody's fix covers yet.
None of this takes new tooling, just treating a coding agent's workspace with the same skepticism you'd give any other process that can write to your machine. Our implementation reviews cover exactly this before an agent gets anywhere near a client estate. AI that ships, not AI that demos.