Coding Agent Horror Stories: The $29 Million Secret Problem
Source: Docker Blog — 2026-07-28
Summary
Docker's latest "Coding Agent Horror Stories" post walks through a case where an AI coding agent holding long-lived, broad-scope credentials became the vector for a $29 million loss after those secrets leaked during a supply-chain-style attack. The post uses the incident to argue that agents need scoped, ephemeral credentials and sandboxed execution rather than the standing access most agent setups grant by default. It's the latest entry in a series that also covered an agent that deleted a production database, continuing Docker's push to make agent governance a concrete engineering problem rather than an abstract risk.
Key Takeaways
- The $29M loss traced back to an AI coding agent holding long-lived, broad-scope credentials that became a single point of failure once compromised.
- Docker's proposed fix is scoped, short-lived credentials issued per-task plus sandboxed execution, so a compromised agent session can't reach beyond its immediate job.
- This is one of several "Coding Agent Horror Stories" case studies Docker has published recently, signaling that agent credential governance is becoming a recurring, quantifiable cost center rather than a hypothetical risk.
Reel Script
Hook (~18s): An AI coding agent just cost a company twenty-nine million dollars — and it didn't write a single line of bad code to do it. It just happened to be holding a secret it had no business holding, and that secret leaked.
Core Concept (~70s): Here's the pattern behind almost every one of these stories: most teams give their coding agents the same standing credentials a senior engineer would have — API keys, database passwords, cloud access tokens — and those credentials just sit there in the agent's environment indefinitely. Think of it like handing a new contractor a master key to the entire building on day one, instead of a keycard that only opens the one room they're working in that day. When an attacker compromises the agent — often through something sneaky like a poisoned dependency in a supply-chain attack — they don't just get the agent, they get everything the agent was quietly allowed to touch.
Hands-On (~90s): Walk through the actual failure chain: step one, the agent is provisioned with a long-lived credential because it's "easier" than scoping access per task. Step two, a supply-chain-style attack — a malicious package, a poisoned prompt, a compromised tool — tricks the agent into exposing or misusing that credential. Step three, the credential doesn't expire and isn't scoped, so the attacker has the same reach the agent had: production systems, billing, whatever that key touched. That's how you get a twenty-nine-million-dollar bill from what looks, on the surface, like a routine coding session. The fix Docker's proposing isn't exotic — it's the same zero-trust idea we already apply to service accounts: issue short-lived, task-scoped tokens instead of standing keys, and run the agent's actual execution in an isolated sandbox so even if the token leaks, the blast radius is the sandbox, not your production estate.
Takeaway (~25s): This isn't a hypothetical — it's a bill someone already paid. If your coding agent has standing access to production credentials right now, you don't have a security policy gap, you have an unpriced liability. Go check what your agent can actually reach today, and scope it down before it becomes your horror story.