◀︎ // Home
Section 02 // The Three Agent Types
Three Roles, Three Blast Radii
Every enterprise agent lands in one of three roles, and the same layer means something different in each. Data-layer poisoning of a coding agent ends in code execution on a laptop. The same poisoning of a productivity agent ends in exfiltrated data from Drive. Of a first-party agent, it ends in enterprise-wide compromise.
Coding Agents
Direct access to local filesystem, shell execution, and package managers on the developer's machine.
RCE via shell-init modification and workspace-boundary violations; binary supply chain from local MCP servers.
Remote code execution on the developer endpoint.
Sandbox; sign & pin MCP binaries; disable auto-execution of agent-generated commands.
Productivity Agents
OAuth-scoped access to connected SaaS; processes high volumes of untrusted external content by design.
The same connectors that make them useful are both the injection channel and the exfiltration channel.
91% of successful attacks end in silent data exfiltration.
Minimize connector scopes; require approvals for irreversible actions; treat tool results as untrusted.
first-Party Agents
Elevated operator trust; broad access to internal APIs, RAG corpora, and enterprise data fabrics.
Tool registry and per-tool authorization; internal connector content trusted by default.
Enterprise-wide blast radius — one compromise propagates in seconds.
Harden the tool registry; enforce per-tool authorization; treat internal content as untrusted input.
The three deployment roles, by trust posture, primary attack surface, and dominant outcome. The meter shows escalating trust and blast radius.
The surfaces shared by all three
The three roles differ, but two surfaces cut across all of them. MCP standardizes how any agent reaches its tools; Skills package the instructions an agent loads as trusted context. Both are shared supply chains — a single poisoned MCP server or Skill can compromise a coding agent, a productivity agent, and a first-party agent at once. Section 6 quantifies the MCP supply chain.
Get the Full Report
Read everything here, free. Enter your email and we'll send the full PDF, including the complete defender playbook.
Frequently Asked Questions
Which type of AI agent is the most dangerous — coding, productivity, or first-party?
There is no single most dangerous AI agent type; the risk depends on blast radius. Coding agents can expose a developer endpoint to remote code execution, with 36% of successful attacks reaching RCE in STAR Labs testing. Productivity agents can silently exfiltrate data across connected SaaS, with 91% of successful attacks ending in data exfiltration. First-party agents can have the largest enterprise blast radius because a single compromise can reach the broader data fabric.
What is the difference between coding, productivity, and first-party AI agents?
Coding agents, such as Cursor, Claude Code, and GitHub Copilot, run on a developer's machine with shell and filesystem access. Productivity agents, such as Microsoft 365 Copilot, Slack AI, and browser agents, hold OAuth-scoped access across SaaS and process untrusted external content by design. First-party agents are built by enterprises on platforms such as Microsoft Foundry or Snowflake Cortex and can run with elevated operator trust inside the company's own systems.
Why does the same vulnerability cause different damage in different agents?
The same AI vulnerability can cause different damage because each agent has a different deployment context, permissions, and blast radius. A data-layer attack can trigger code execution on a coding agent's endpoint, cause silent data exfiltration through a productivity agent, or result in an enterprise-wide breach through a first-party agent. The Straiker STAR Framework captures this distinction: the layer determines the attack mechanism, while the agent type determines the consequence.
