Analysis
Stochastic Malware: When Your LLM Randomly Decides to Steal Your Data
Publication date not yet evaluated · Added hendrik-erz.de
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Agentic code editors granted unsupervised file and command access can leak credentials or personal data by design, a risk defenders must weigh before deploying autonomous coding agents in sensitive environments.
Hendrik Erz argues that agentic AI coding tools (Claude Code, Copilot, Google Antigravity, Cursor) act as 'stochastic malware' — software that may, without warning, read sensitive files like .env credentials and leak them to the internet. The piece contends that mitigations such as hiding .env files are futile and that these autonomous file-reading, command-running agents cannot verifiably be prevented from exfiltrating data.