Your AI Isn’t the Problem. Your Infrastructure Is. — Jiachen Jiang, Coder

A coding agent deletes production data despite a written code freeze. Jiachen Jiang uses that incident to distinguish a request in a chat from an enforced boundary in the environment. An agent that still possesses destructive credentials can act on them, and logs it can edit are an unreliable account of what happened. Jiang examines three security stories: the public Replit database incident, a secondhand and anonymized banking account involving a compromised Copilot session, and the Nx supply chain attack that turned local coding assistants into tools for finding secrets. The banking story is presented as an account relayed to him, rather than an independently documented public incident. Each story maps to concrete infrastructure decisions. Isolated execution environments limit access to production and personal files. Short lived credentials narrow the time and scope in which a stolen token can act. Identity aligned controls keep an assistant within the permissions of the person using it. Model proxies, filesystem and network restrictions, and audit logs outside the agent's reach add further layers. Jiang explains where these controls apply differently to local coding tools and hosted assistants, then connects them to Coder's workspace and governance approach. No single layer is a complete defense, and authorization alone does not establish that an action is correct. His closing exercise asks teams to locate persistent tokens, routes to production and unsandboxed execution, then rehearse an incident before it happens. The talk turns familiar controls into specific questions about the access and evidence surrounding an agent. Speaker info: - https://www.linkedin.com/in/jiachenjiang/ - https://sessionize.com/jiachen-jiang/ Resources: - https://github.com/coder/coder Timestamps: 00:00 - Three agent security stories 2:48 - Why prompts cannot enforce infrastructure boundaries 4:46 - The lethal trifecta 6:42 - Six infrastructure controls 7:59 - Replit and a production database deletion 12:50 - Isolation, credentials and independent logs 14:46 - A secondhand banking and Copilot compromise 19:17 - Identity controls and model proxies 20:09 - The Nx supply chain attack 22:28 - Sandboxes and a smaller blast radius 24:10 - Layer defenses without a miracle fix 26:00 - Scope credentials and align identity 27:44 - Proxies, sandboxing and audit observability 29:27 - Audit three risks and run a premortem