Every piece of code the agent generates and every execution attempt — successful or not — should be logged with: the full code text, the timestamp, the input that triggered it, the execution result, and any external connections or filesystem operations performed.

Why full code logging matters: Post-incident investigation of an unexpected code execution is impossible without knowing what code ran. Partial logging (just outcomes, not code) leaves the root cause unexaminable.

Behavioral anomaly detection: Over time, a baseline of normal code execution patterns can be established. Deviations — unusual syscalls, unexpected filesystem paths, outbound connections to new destinations, resource consumption spikes — should generate alerts even if the code technically executed "successfully."

Immutable audit trail: Logs must be written to a store the agent cannot modify. An agent that can edit its own execution logs provides no real accountability.

For coding agents that generate application code for review and deployment (rather than executing it immediately in an interpreter), the generated code should pass through security scanning before it reaches a repository or deployment pipeline.

Secret scanning: Tools like truffleHog, git-secrets, or GitHub's built-in secret scanning detect hardcoded credentials, API keys, and tokens in generated code before they're committed.

Static Application Security Testing (SAST): SAST tools (Semgrep, CodeQL, Bandit for Python) can detect backdoor patterns, dangerous function calls, SQL injection vulnerabilities, and other security issues in generated code using the same rules they apply to human-written code.

Dependency confusion / malicious import detection: Generated code that imports unexpected packages should be flagged before those packages are installed in the project. This catches Type 5 backdoor attacks that work through dependencies rather than direct code.