Answer

What can an AI coding agent access on my machine?

An AI coding agent that runs as your own user account can reach almost everything you can: cloud credential files, SSH keys, package-registry tokens, kubeconfig, shell history, environment variables, and any MCP server configs sitting on disk — unless a specific deny rule or sandbox stops it first. blast inventories that local exposure in about two seconds, read-only and offline.

Updated 2026-10-02 · Kloudle

Why does an AI coding agent get the same access you have?

An AI coding agent doesn't get its own restricted identity — it typically runs as you. Aurascape's breakdown of coding-agent permissions groups the risk into file read and write, shell command execution, git operations, package installation, cloud API calls, and MCP tool calls, with specific sensitive locations called out: .env files, SSH keys, package-registry tokens, AWS and gcloud credential profiles, and GitHub personal access tokens and deploy keys (aurascape).

hoop.dev frames the consequence in blast-radius terms directly: a standing credential with broad rights means the radius is everything that credential can touch, usually far more than any single task needs, and without a record of what the agent touched, you can't quickly see or reconstruct the spread (hoop.dev). Neither framing requires the agent to be compromised or acting outside your instructions — the access is simply present, available to any tool call the agent decides to make, including one you didn't anticipate when you started the session.

What's actually sitting in reach, mapped to what blast reports?

The table below maps common local locations to what they grant and whether blast's scan surfaces them.

What's intentionally out of scope?

Some things stay out of scope on purpose. Browser saved passwords and OS keychains aren't covered. Arbitrary source code isn't scanned for hardcoded secrets in general. Encrypted secret stores aren't opened. Results describe exposure — what an agent running as you could read — not proof that any credential was actually used or compromised, and a clean result in one of these categories doesn't mean the category was checked and found empty; it means the category sits outside this particular scan's design on purpose.

What should you check first?

Start by running the scan where you work: npx -y @kloudle/agent-blast-radius@0.3.0, or install it for your platform from the install guide. The output is a 0–100 score with a breakdown table and JSON for scripting, so you can see exactly which categories above are contributing before deciding what to lock down, sandbox, or move to a secrets manager.

Check your own machine

Frequently asked

Can an AI coding agent access my AWS keys without me doing anything special?

Yes, if the credential files are readable by your account, which they normally are. Both aurascape's and hoop.dev's write-ups point to this as the default, not an edge case.

Does broad access mean the agent is doing something malicious?

No. Access describes capability, not intent. hoop.dev's point is that a standing, broad credential makes the potential damage large regardless of whether anything has gone wrong yet.

Can blast see the actual values of my secrets?

No. It reports credential type, location, and a fingerprint, never the value itself, and the scan never leaves your machine unless you opt into paid verification, which sends only class counts.

Sources

1. AI coding agent permissions: files, shell, git, cloud — aurascape
2. AI coding agents: what they mean for your blast radius — hoop.dev
3. Configure permissions — Claude Code docs

Related

• What is agent blast radius?
• Can Claude Code read my .env file?
• Can my MCP config leak hardcoded secrets?
• Can an AI coding agent use my kubeconfig / access my Kubernetes cluster?