Coding agents and data agents routinely interact with the filesystem as part of their work — reading input files, writing output, managing working directories. The risk is code that operates on files outside the intended scope.

Scope creep by ambiguity: "Delete the old logs" becomes os.remove() applied to every file matching a broad pattern — including production logs still being written to, or configuration files mistakenly matched by the pattern.

Path traversal in generated code: Code that processes user-provided paths without validation can be manipulated to traverse outside the working directory — reading ~/.ssh/id_rsa, /etc/passwd, or application secrets outside the intended working directory.

Documented pattern: Multiple coding assistants (Claude, GitHub Copilot, Cursor) have been reported in research and user incident reports to generate file deletion code that was broader than intended when given natural-language cleanup instructions. The code was correct SQL for the goal it inferred — but the inferred goal was wrong.

An agent with code execution capability and outbound network access can generate a script that sends data to an external endpoint. This is distinct from the agent itself making an API call — it's the agent writing code that makes the call, using the interpreter's network stack.

Via malicious instruction: A crafted input tells the agent to "process and summarize this data, then send the results to this URL" — where the URL is attacker-controlled. The agent writes a requests.post() call and executes it.

Via legitimate-looking code generation: An agent asked to "send a report" generates code that reads credentials from the environment and includes them in the request body — a common pattern in internal tooling that, when generated autonomously, sends secrets to wherever the agent was told to send the report.

The mitigation: network egress restriction. An agent whose interpreter has no outbound network access cannot exfiltrate data through code, regardless of what code it generates. This makes network isolation (MIT02) the single most effective control for Type 3.