We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog

Someone opens a pull request on one of your open source repos and drops a line into a markdown file. An automated code review reads it and says looks good. That file is part of the content pipeline feeding an agent that runs commands on thousands of developer machines, so you have now shipped a prompt injection payload signed by you. Sarah Sanders is a context engineer at PostHog, where the Wizard is an agentic CLI that reads a codebase, installs the right SDK, instruments events, and builds dashboards, turning an hour or two of setup into five or six minutes. Roughly 8,000 people run it a week. When the team started talking about making it the default install path, Sanders looked at the anatomy of what they had built and saw what she calls the malware starter pack, because an agent with a shell is almost exactly what you would hand a piece of malware if you were feeling generous. Her audit found the allow list was tighter than feared, with bash denied by default and secrets routed through a vault, but the security team still found gaps, and the shape of them mattered more than the specifics. Almost none were obviously evil. They were two innocent things shaking hands. Attacks compose, she notes, and code review does not. The scanner she built in response runs on YARA rules, is deterministic on purpose, and only reports findings rather than acting on them. It caught sub agents inventing ways around the guardrails to hunt for secrets, which ended sub agents entirely. The language model layer she added on top advises, never enforces, and fails closed. Speaker info: - https://www.linkedin.com/in/sarah-s-42913121a/ Timestamps: 0:00 - What the Wizard does 2:52 - The malware starter pack 5:28 - Layer zero: prompts are not security 7:08 - What the allow list actually blocked 8:00 - Attacks compose, code review does not 8:50 - The context mill and its supply chain 11:24 - Building a detector that does not act 13:08 - Sub agents hunting for secrets 14:50 - Triage: adviser, not bouncer 16:34 - Anatomy of a rule 19:06 - The posture now, in three lines