How to secure Codex, Cursor and other AI coding agents

Last updated 23 October 2026

The same rules keep every AI coding agent safer, whichever one you use. This checklist works for Codex, Cursor, Gemini CLI, GitHub Copilot, Windsurf, Kiro and the rest.

The checklist

• Use the agent's sandbox and approval settings, and keep stricter settings for code you did not write.
• Never paste or store real secrets where the agent works. Prefer short-lived, limited tokens.
• Treat everything the agent reads from outside (pages, issues, pull requests, package docs, MCP tool results) as untrusted input that may contain instructions.
• Install skills, plugins and MCP servers only from sources you trust, and review them when they update.
• Watch for an agent changing its own configuration, especially switching to a mode that no longer asks you.
• Be wary of package publishing, installs from unofficial registries and new startup items that you did not request.
• Keep backups and a copy of important projects elsewhere.

Seeing what every agent does

• Most people run more than one agent. AgentWarden recognises about thirty AI agents and agentic IDEs from a signed catalogue that updates without app releases, and shows each one on its Live page with when it was last active.
• Codex and Claude Code are read in full detail: every step is judged against what you asked. For the others, the commands they start, their skills and their settings are checked, but they are not yet read line by line.
• Everything runs on your own Mac or Windows PC. Code and transcripts are never uploaded.

Limits worth knowing

Some tools run agents inside a sealed container or virtual machine of their own. What happens in there never reaches your computer, so AgentWarden cannot watch it, and it tells you so. On Windows, a tool installed only inside WSL is not seen. See the Limits page.

Questions

Does AgentWarden work with Codex?

Yes. Codex is read step by step from its session logs and every step is judged against what you asked, like Claude Code.

Does it work with Cursor?

Cursor is recognised running, and the commands it starts, its skills and its settings are checked. It is not yet read line by line.

Mac or Windows?

Both, with the same engine and the same rules: macOS 14 or later on Apple silicon, and Windows 10 or 11 from the Microsoft Store.

More guides

• What is antivirus for AI agents?
• How to secure Claude Code on your computer
• Detecting prompt injection in AI coding agents
• Checking MCP servers and agent skills for malicious instructions