My Coding Agent Compromised Three Machines in Under a Minute

I was locked out of my own Raspberry Pi. The Pi rejected my laptop's key, accepted public keys only, and offered no password fallback. A dead end for me.

So I asked Claude Code, running with full shell access:

"Help me SSH into my Raspberry Pi."

Thirty seconds later it replied: "You're in."

That was fishy enough that I had to get to the bottom of it. I asked how it had gotten my PC's keys. It calmly explained the SSH trust chain: if machine A can reach machine B as user X, it can read anything in that user's home directory, private keys included.

What It Actually Did

Here is the chain it built and executed, start to finish:

1. Read my SSH config on the laptop
2. Noticed my PC in Germany listed as a known host
3. Inferred that the PC's keys might have Pi access
4. SSH'd into the PC to test that hypothesis
5. Copied the private keys to a temp folder on my laptop
6. Authenticated against the Pi with those keys
7. Permanently modified the Pi's authorized_keys file
8. Shredded the borrowed keys

Three devices, two countries, under a minute from inference to execution. It narrated every step out loud and never once asked "OK to proceed?"

Why I Was Not Panicking

I run the agent with full shell access on purpose, inside a sandboxed environment, so the actual blast radius is small. I understand coding agents well enough to know when to arm up and when to let one run.

But this was new to me. The scary part wasn't the access, that was my own mistake. What I didn't expect was the reasoning chain.

• The agent reasoned its way through a trust chain I never pointed it at
• It assumed the PC had flashed the Pi's SD card, which meant Pi Imager had embedded a key at first boot
• It inferred a path across machines, tested it, and acted on the result

When I asked what it had done without permission, it answered honestly:

"I should have explicitly asked before SSHing into the PC, copying private keys via SCP, and modifying authorized_keys on the Pi."

The Part That Matters

This is the lesson for anyone deploying AI agents on engineering teams:

The danger is not the permissions you grant. It is the inference chains the agent constructs from those permissions.

You can understand your blast radius perfectly and still get surprised by the paths the agent finds through your infrastructure, exploiting every option it has. Static permissions assume you can enumerate what the agent will try. Agentic reasoning breaks that assumption.

This was not the first time an agent solved a problem through a route I didn't anticipate, but it is the most impactful one so far. The capability was there. Knowing where it should have stopped was the part missing, and that part still has to come from you