The Agent Found Another Way: Why Source Code Security Has to Follow the Data

There’s a scenario is one we’ve seen play out repeatedly within our customer base, and it typically goes like this:

A developer at an enterprise organization asks their AI coding assistant to push a small fix to a vendor's GitHub repository. The company’s firewall blocked the push. The agent tried again over SSH and was blocked, again. So it asked the developer for broader permissions, got them, and found a third route. The agent used the developer’s GitHub credentials to write the files directly through GitHub’s API. The firewall saw ordinary API traffic and let it through.

Cyberhaven is able to stop the agent's action right on the laptop.

Neither developer nor agent was malicious in this scenario. The developer meant well, and the agent was just determined to finish the job. That's what makes this kind of leak so hard to catch, it doesn’t look like a nefarious data breach at all.

Developer Workflows Were Already Hard to Secure

Source code is one of a company's most valuable assets, and it lives directly on developers' laptops. Developers move code all day as part of their jobs, across many tools and channels, most of them encrypted. Security teams have always had the challenge of stopping the wrong push without slowing down the thousands of right ones.

AI coding agents make this exponentially harder. Tools like Claude Code, Cursor, and Copilot work with the developer's own access and operate at machine speed, multiplying the volume of code and pushes possible.

Coding agents aren't malicious, but they're relentless and resourceful. When a control blocks them, they treat it as an obstacle and look for a way around it. And they're spreading across environments fast: Cyberhaven Labs found that endpoint-based AI agents grew 509% in 2025.

Why The Firewall Alone Misses Agent Actions

In the above example we’ve seen across environments, the firewall did exactly what it was configured to do. Using TLS/SSL decryption, it blocked Git pushes to outside repositories. But code can leave an endpoint many ways, and a firewall can only block the ones it has a rule for.

• Git over HTTPS (Smart HTTPS via HTTP POST) is the most common method. Pushes to unapproved repositories can be blocked at the firewall, but only with custom signatures applied to decrypted traffic.
• Git over SSH can't practically be inspected at the firewall like HTTPS, so it's either all blocked or all allowed.
• GitHub’s API can write files directly, with an HTTP PUT to its file-contents endpoint. That route has to stay open for everyday developer tools, and blocking one endpoint still leaves others. That’s the door the agent used.

Each rule guards one channel, and a persistent agent just tries the next one. The firewall can see which door the traffic used. It can’t tell what the data is, or where it came from.

How Cyberhaven Stopped the Agent Action

Cyberhaven looks at the data and the channel. The platform knows which files came from the company's code repositories, and it follows that code wherever it goes, whether a person, or an agent, moves or transforms it.

When code starts to leave the endpoint, like a developer’s laptop, Cyberhaven checks it against policy before it's sent. If it's corporate source code headed somewhere it shouldn't go, Cyberhaven automatically blocks it. The security team then sees what moved, where it came from and what tried to move it. Because the check happens on the device, it works the same over Git, SSH or an API call.

Every control that judged the channel said yes. Only the control that judged the data said no.

One Policy for Humans and Agents

Git push blocking builds on years of Cyberhaven's Data Lineage work. First, we traced source code back to its repository, then we gained visibility into every push. Now we block risky pushes on Windows and macOS before they ever leave the device.

But in the end, the agent in this story got the code out without using Git at all, and that's the point. What matters is being able to see if the source code went somewhere it shouldn’t, no matter who or what moved it. And be able to take action in that moment, on the endpoint.

Cyberhaven's data security platform is built to take action when and where it matters with one policy that follows the data across human and agentic workflows.

Keep the firewall, because layered controls work. But any control tied to a channel invites a persistent agent to try the next one. The control that held here knew what the data was and where it came from.

AI changed work. Cyberhaven protects it. Request a demo to see Agentic Data Security in action.