Claude Code’s Hundreds of Agents Need Narrower Keys

One Claude Code operator can dispatch hundreds of subagents across a framework migration. The workers multiply faster than people can review their branches, tool calls, and credentials. That leaves security teams with a question the chat window cannot answer: who gave each worker the keys?

Parallelism turns a coding session into an authority graph

At first, coding assistants fit inside a conversation. A developer asked for code, the model produced it, and the developer remained the obvious center of the workflow. Even when the output was wrong, the unit of review was human-sized: one response, one diff, one decision.

Claude Code’s dynamic workflows break that shape. One operator can delegate complex engineering work to hundreds of subagents running in parallel, including framework migrations. The system becomes a graph connecting an operator, an orchestrator, subagents, repositories, tools, environments, and credentials.

Each subagent can act, and each edge grants permission. One worker may need to read a repository. Another may need to write a branch. A third may invoke a tool or inspect an environment. If every worker inherits the operator’s standing access, the organization has replicated a human security principal hundreds of times.

Cursor Automations can launch agents after a codebase change, a Slack message, or a timer. Apple added Anthropic and OpenAI coding agents to Xcode alongside MCP support. A person no longer has to sit in an interactive session for agents to become participants in the development system.

Vendors did not need to coordinate this shift. When each worker costs little to instantiate, developers have reason to assign more of them. Human reviewers do not scale at the same rate, so the control system cannot depend on a person inspecting every action before it occurs.

Logs describe authority after it has already acted

Security teams still need durable records for attribution, tamper detection, incident reconstruction, and accountability. If an agent changes a branch, invokes a tool, or crosses an approval boundary, they need a reliable account of that action.

But a log is evidence, not a gate. It can record that an actor read a secret, published a package, or changed a production artifact. It cannot narrow a credential after someone has used it. At machine speed, observing authority produces an audit record; constraining it provides control.

The CISA credential leak makes the mechanism visible. Weak controls around public GitHub repositories allowed a human contractor—not an autonomous agent—to expose private cloud access keys and other credentials. The incident was not agent-caused; it exposed the blast radius created when an actor encounters authority broader and more portable than the task requires.

Because delegation is cheap, agents multiply that old problem. Security teams must stop giving each worker the human operator’s reusable secret.

1Password’s Claude integration illustrates the alternative. The agent can sign in to a website without seeing the password or two-factor code. It receives authority to perform an action without possessing the underlying secret. Credentials can be brokered as task-bounded capabilities rather than copied as standing identity.

OpenAI added native sandboxing and an evaluation harness to its Agents SDK. Credential brokerage, sandboxing, policy gates, source-control protections, and telemetry each constrain a different failure mode. These features do not prove that adoption or operational quality is adequate, but they show that builders have located the problem below the chat interface.

Under deployment-layer control, each agent receives its own machine identity, minimal permissions, bounded duration, and explicit approval requirements for high-impact transitions. Teams run agents in isolated environments with recoverable checkpoints. They keep logs as evidence after preventive controls have bounded the work.

Developer infrastructure is following the concurrency

Builders often reveal a workload shift before companies find language for it. They increasingly design the developer stack for many concurrent machine actors rather than a smaller number of faster humans.

Entire launched a decentralized Git network, with servers in the United States, the European Union, and Australia, specifically to handle high coding-agent traffic. Its founder has also described tamper-evident branch history and independently verifiable policy-as-code branch protection as planned capabilities, treating capacity and governance as one design problem.

GitHub offers the incumbent confirmation. AI-driven growth reportedly strained its infrastructure and contributed to dozens of major outages in 2026, while Microsoft looked to add AWS capacity. GitHub built source control around human development rhythms; machine-generated concurrency is testing those assumptions.

Repositories, not models, must enforce branch policy, scoped writes, approval gates, build limits, and rollback. Those controls have to travel with the development graph because the graph persists when models, tools, and workers change.

Across the compared 2024–2026 periods, enterprise framing in Anthropic coverage rose from 12.3% to 19.0%, while research framing fell from 40.3% to 22.0%. The shift follows the infrastructure: institutions increasingly treat Anthropic as a supplier inside production workflows, where authority allocation matters more than benchmark behavior.

Supply-chain blast radius scales faster than review

The software supply chain makes delegated authority unusually consequential because one accepted change can propagate far beyond the system that produced it. Packages, branches, automated commits, and downstream dependencies turn a local action into distributed exposure.

The compromise of the Axios npm package introduced a malicious dependency into affected releases of a package with 100 million weekly downloads. TeamPCP was separately reported to have conducted 20 waves of supply-chain attacks compromising more than 500 pieces of software. Neither case establishes that coding agents caused the attacks. Both expose the propagation machinery that an incorrect, malicious, or over-privileged automated action would inherit.

Coding agents also change offensive economics by automating parts of vulnerability discovery. The same falling cost of machine execution increases both useful code production and exploit search capacity.

Reviewers cannot remain the primary boundary. Agents can expand output in parallel; reviewer attention remains finite. A larger queue of diffs records the mismatch without resolving it.

Teams therefore need to stage agent writes, confine them to branches, checkpoint them, and roll them back before they become durable downstream state. Recovery has limits: it can reverse code changes, not revoke knowledge of an exposed secret. Credential scope must come first, with telemetry preserving the record after preventive boundaries act.

Policy has to survive the choice of model

Providers’ model-level refusals remain contested controls. Satya Nadella’s criticism of Claude Fable 5 as “editorially controlled,” including its refusal to do “any random thing,” makes that contest explicit. Enterprises disagree about what models should refuse even before deciding what connected agents should be authorized to execute.

Enterprises are also building multi-model environments. The EU Parliament is reportedly preparing a hub that would place access to models from Meta, OpenAI, Anthropic, and Mistral under institutional control. Microsoft reportedly plans an AI security tool using models from Anthropic, OpenAI, and Microsoft itself. One provider’s refusal policy cannot govern procurement designed to span providers.

An enterprise can pair a restrictive model with broad credentials and still build a dangerous system. With narrow identities, sandboxes, policy gates, and recoverable state transitions, it can constrain a more permissive model. Model behavior remains one layer of defense; it cannot authorize the rest of the stack.

Because enterprises can substitute models, they must attach policy to actors, credentials, and state transitions rather than to one provider. The control plane must identify each subagent, grant task-bounded authority, and revoke access regardless of which model is doing the work.

One Claude Code operator can still create hundreds of subagents. Trust does not come from watching them all; it comes from giving each worker a narrower key, for less time, and taking it back.