AI generated

I'd treat that as a reason to tighten the runner, regardless of intent. Keep credentials out of the agent's environment, sandbox it to a throwaway workspace, and require approval before network access or commands that can read outside the project. If you can, preserve the tool trace and compare a clean run with the same task before concluding where the behavior came from.