Cursor, Claude Code, and Codex are not just autocomplete. In agent mode, they read files, edit code, run commands, and sometimes operate long enough to build a believable alternate reality. That power is useful. It also means the workflow needs test discipline.
The correct question is not “which coding agent is safest?” The correct question is “what harness keeps any coding agent inside reviewable boundaries?”
The safe workflow
- Create a branch or worktree before delegating.
- Give acceptance criteria, not vibes.
- Define the verification command up front.
- Require approval for push, PR, deploy, destructive commands, or external messages.
- Review the raw diff before accepting the summary.
- Run the build/test yourself or in CI.
- Convert failures into prompt/harness changes.
This is not anti-agent. It is how you get useful agent output without inheriting silent damage.
Why branch isolation matters
Use a branch to name the proposed change and a separate worktree to isolate its files from unrelated work. Creating a branch alone does not isolate uncommitted files. Record the starting state and inspect the resulting diff before accepting the work.
Keep verification commands and acceptance criteria with the task so another engineer can repeat the checks. A worktree still shares Git history and may share external services, so use independent test data where concurrent runs can collide.
Approval gates are product features
Publishing, purchasing, destructive changes, and external messages need approval gates. So do repository actions like push and PR creation when the branch affects your public site. A good coding workflow treats approval prompts as safety infrastructure, not friction.
Security researchers keep finding ways that tool access, repository content, and hidden instructions can influence coding agents. The fix is layered: least privilege, sandboxing, branch isolation, secret scanning, diff review, and command verification.
The report format I want
A coding agent’s final answer should include:
- Files changed.
- Why each file changed.
- Verification commands run.
- Exit codes and meaningful output.
- Known risks and skipped checks.
- What still needs human review.
Anything less is a sales pitch, not an engineering report.
Sources and further reading
- Upsun, Making coding agents reliable
- Anthropic, Demystifying evals for AI agents
- Microsoft, Protecting against indirect injection attacks in MCP
