We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog

An agent's security depends on the material it reads as well as the commands it may run. A PostHog conference account describes a possible attack path: malicious instructions enter a repository document, pass review, and later reach an agent through its content pipeline.

The response described includes a deterministic scanner that uses explicit detection rules and reports findings without taking action. A language-model layer advises on those findings rather than enforcing policy. Separating inspection from execution is meant to avoid giving the component that examines suspicious material the same authority as the agent doing the work.