I work with AI agents every day. Claude Code has access to my terminal, my repositories and, as I just found out, quite a lot more than I thought.
I’m building RosmarOps, a tool that reads your agents’ configuration and draws an exposure map: what each one can read, what it can change, which keys it can reach, and whether one agent can rewrite another’s configuration. The first machine to go through it was mine. Claude Code’s Agent Posture Score: 18 out of 100. Band: Exposed.
What the score means, and what it doesn’t
It isn’t a verdict on whether I’ve been hacked. It doesn’t say whether anyone has attacked me or will. It says what an agent could do with the permissions it has today. And it only covers what RosmarOps was able to read: anything it couldn’t read isn’t counted as clean.
What it found
It found 4 urgent findings and 4 to review. From any of my projects, Claude Code can read high-privilege credentials, and it has ways to send them out without any person approving it: some are decided by another AI model, and others not even that, because I had pre-approved those commands myself. It can change the configuration of two other agents I have installed. And it can rewrite the instructions I leave for it in my projects.
Part of it was me. Part of it was the default.
Part of this is on me: permissions I granted along the way so I wouldn’t have to approve every command. Part of it I didn’t decide. In recent versions of Claude Code, “auto” is the mode it starts in unless someone picks another. In that mode, most of what it used to ask me about, it no longer asks: reads and edits inside the project are approved automatically, and almost everything else is decided by a classifier, which is another AI model. Only a few actions still ask for my permission. I didn’t turn it on: it came that way. It happens to anyone with a recent version who hasn’t chosen another mode.
One alarm, not a hundred
The report didn’t give me a hundred alarms. It gave me one: “if you do only one thing today, do this”, with the exact setting to change. And it told me what would happen to the score if I did: from 18 to 22. Still red, and rightly so. One setting doesn’t fix a machine.
Nothing leaves the machine. Nothing gets changed.
Two design decisions I care about. It doesn’t connect to the internet or send anything, not even if you want it to: there’s no telemetry switch because there’s no feature that sends data. And it doesn’t touch anything: it suggests, and you make the change.
Where it stands today
Right now it only evaluates Claude Code on Windows. It detects Cursor and Cline, but doesn’t score them yet. It can’t be downloaded yet. When I release it, you’ll be able to check for yourself that it’s authentic.
If you work with agents, here’s the question I asked myself: do you know what yours can read right now?
Update, 25 October 2026: RosmarOps now also scores Cursor. Cline is detected but not scored yet.
I wrote this with AI assistants. The machine, the findings and the decision to publish are mine.