Clodex

Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you. Vultr — starts at $6/mo DigitalOcean — $200 credit for new users Here’s a question I haven’t seen anyone ask about AI coding agents: what happens when the model is wrong — not just bad code, but malicious? Every agentic tool today — Cursor, Claude Code, Codex, OpenCode — works the same way: the model proposes an action, and the tool trusts it. Maybe it asks for confirmation before running shell commands. But the model picks which commands to run. The model chooses which files to read. The model decides which npm packages to install. The model holds the keys. ...

Ever watched an AI agent propose running sudo rm -rf /? You thought, “Yeah, that’s a no from me”? Dark joke. But it hits a problem every agentic coding tool has. I’ve used Cursor, Claude Code, Codex, OpenCode — the whole lineup. They’re all great at writing code. The thing is, they share one bad habit: trust the model by default. The model says it needs access to my terminal? Fine. It wants to install a package from a random npm registry? Sure. It needs my GitHub token? Go ahead. Then that trust burns you. ...