- Endor Labs argues that instruction files such as AGENTS.md guide a coding agent but do not secure it, because the model decides whether to follow them.
- It says agents read files, run commands and install packages before pull request review, and that a hook with a suitable policy can block actions first.
- A hook enforces only the rules someone wrote, and Endor Labs, a vendor, publishes no measured results. Ask who writes the policy and how it is kept current.
Many teams now write a careful instruction file for their coding agent. It says: do not read .env, do not run destructive commands. For many teams the file can feel like a safeguard. Endor Labs, a software supply chain security vendor, says it is guidance, not a control.
The distinction is worth keeping. A rule you ask a model to follow is a request. A control is something the model cannot decline. Endor Labs' October guidance argues that a written rule gives you the first and not the second.
The agent acts before anyone reviews
Endor Labs' point is about timing. A review at the pull request sees the finished code. It does not see the steps along the way, such as which files the agent opened, which commands it ran or which packages it installed.
The company lists three changes when agents write code. Agents act before review. Code arrives continuously. Pull request volume outpaces what humans can read.
That changes what a security purchase can do. A scan of finished code cannot undo a credential that was already read.
Why a rules file is not enough
Prompt injection can arrive indirectly. An agent processes text it did not write, such as issues and repository files, and that text can carry instructions. Endor Labs' example is an issue with a hidden line asking the agent to paste the contents of .env into a pull request comment.
Here is the weakness of a rules file. It is one more piece of text the model weighs. Endor Labs says an instruction planted in an issue can win out over the one in your configuration. When the only barrier is the model's willingness, a hostile instruction competes directly with yours.
How a hook works
Endor Labs describes a different approach. Agents such as Claude Code and Cursor offer hooks, which are points where separate software can inspect a tool call or shell command before it runs. A policy examines the action and answers with permit, refuse or record for audit.
With a suitable policy, a hook can stop a command such as rm -rf ./ or a read of ~/.aws/credentials before it executes. Endor Labs describes the policy in its guidance as illustrative. Two conditions apply. Someone has to write the policy, and the agent has to expose hooks. The guidance names Claude Code and Cursor as examples.
Two ways a package name goes wrong
Endor Labs also argues that dependency checks run too late. If you scan after code lands, any install script has already executed.
It cites a 2025 USENIX Security paper, "We Have a Package for You!", on package hallucination. Endor Labs reports that the paper found models regularly suggest packages that do not exist. Many of those invented names return across repeated prompts. Because they repeat, an attacker can anticipate them and register them. Researchers call this slopsquatting.
The company's walkthrough shows something different. In its scenario, the agent tries to install a package whose name is a misspelling, and that misspelled name has already been claimed by someone else. That is a mistyped name, not an invented one, so it is a related trick rather than slopsquatting. The advice covers both: vet a package at the moment the agent requests it.
The flaw a scanner has nothing to match
Endor Labs cites Veracode's 2025 GenAI Code Security Report. According to that report, output from more than 100 language models was tested across 80 coding tasks spanning Java, JavaScript, Python and C#. In 45% of the generated samples, the code contained a security flaw.
Endor Labs gives a password reset handler as an example. It has no SQL concatenation, no dangerous call and no hardcoded secret. The weakness is a missing check: a signed-in user can reset another person's password by supplying a different user_id. That is an insecure direct object reference, a form of broken authorization.
Finding it means reasoning about who is calling and what they own. Pattern-matching rules have nothing to look for.
What a hook cannot do
Endor Labs sells products for each layer it describes, so read the guidance with that in mind. The article offers no measured results from customers. Some ideas echo OWASP guidance it cites, such as keeping an allowlist of approved MCP servers.
Here is the publication's own reasoning. A hook enforces only the rules someone thought to write. Its strength is the strength of the policy. An action nobody anticipated passes through, and the model's willingness to comply is no longer the problem, but the policy author's foresight is.
So the budget decision is a trade-off, not a swap. Policy work costs engineering time to write and keep current. Stricter policy asks more of developers. Endor Labs says controls should sit where developers already work, because a new portal or endpoint agent hurts adoption. For rollout, it recommends starting with a full inventory, then rules on agent actions, then checks when packages are installed. Review of the code and pull requests comes last.
Questions for your security team
Can you list every coding agent, model, MCP server and skill in use, approved or not? Endor Labs puts this first. MCP servers connect agents to outside tools, and it says their tool descriptions can change after approval.
Is any rule for agents enforced by a hook, or only written in a file? Who owns that policy, and who adds to it when the team finds a new gap? Are production secrets kept out of the agent's environment? Endor Labs advises this so an injected instruction has no key to take.
Do CI definitions, signing keys and deployment authority sit outside the agent's reach? Endor Labs notes that an agent with write access to a repository could change the workflow that tests its own code. Its scenario has an agent editing a workflow to skip a failing auth test. It also says an agent should not approve its own work. Human sign-off should cover workflows, auth code and security tests.
Last, can you revoke an agent's credentials and end a running session within minutes? Endor Labs says if either takes longer, fix that first.
A written rule asks. A hook with a good policy refuses. Fund the second, and keep asking who wrote the policy.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Endor Labs.
