Coding agents access credentials and call external services as a normal part of their workflow. A recent security analysis quantified the exposure: AI coding agents read files, consume secrets, and reach external services as a side effect of doing their job. None of that activity appears in a pull request. Security teams reviewing diffs see only the output. They do not see what the agent accessed or what it sent outbound along the way. The gap between what an agent does and what a reviewer sees is the actual attack surface. Diff review is the dominant AppSec control for code changes, and it is structurally blind to this class of activity. For AppSec practitioners who have deployed coding agents: how are you getting visibility into credential use and outbound calls that happen mid-task and never land in a diff?   submitted by   /u/No-Conclusion3720   to   r/deeplearning [link]   [comments]