Most AI coding agents have zero security. I read the source code of 12 to prove it.

I've been reading through the source code of open-source AI agents — not the docs, the actual implementations. 12 projects so far.

The security situation is worse than I expected.

Cline (60K stars, most popular VS Code coding agent): "YOLO mode" is a single boolean that bypasses ALL permission checks, including shell command execution. There's actually a decent CommandPermissionController in the codebase that validates commands, but it's behind an env var nobody sets. Flip YOLO on and the agent runs commands with your user privileges, no sandbox.

Only 2 out of 12 have real security:

• Goose: 5-inspector pipeline runs before every tool call. One inspector calls the LLM itself to review suspicious operations. Plus a 31-key env var blocklist against DLL injection. Best I've seen.
• Codex CLI: Actual OS-level sandboxing — seatbelt on macOS, Landlock on Linux, Docker fallback. The only agent that doesn't trust the process boundary.

Everyone else: runs tools in-process with the main agent. No sandbox, no isolation. DeerFlow's security docs literally say "improper deployment may introduce security risks" and that's it. For a project at 58K stars.

Other findings across 12 projects:

• Every single one has a God Object (worst: 9,000 lines in one file)
• Nobody has solved cost budgets — only Dify has real execution limits at the infra level
• Claude Code ships 18 virtual pet species in production (not a joke)
• Pi Mono has a stealth mode that impersonates Claude Code's tool names to dodge rate limits

Full teardowns with architecture diagrams and code references for all 12:

https://github.com/NeuZhou/awesome-ai-anatomy

Working on Cursor, Aider, and OpenHands next.