Executive Summary
Agent Remit (as declared)
Aider is an interactive AI pair-programming agent that runs in the developer's terminal against a single local git repository, on the developer's own account and LLM credentials. It reads repository files the developer shares into the chat, proposes edits to satisfy natural-language requests, applies approved edits to the working tree, and auto-commits them with a descriptive message the developer can review or
/undo. High-impact actions — executing shell/test/lint commands, installing packages, self-upgrading, scraping URLs, committing — are meant to stay developer-gated, and Aider must never push autonomously, write outside the repository root, leak secrets into context or git history, follow instructions embedded in untrusted file content, or send code/prompts/keys/PII to any telemetry or third-party endpoint.Behavior Summary (as observed)
The dominant pattern is a mature agent whose safety model is deliberately the developer-in-the-loop confirmation, with almost no deterministic, code-level enforcement behind it — so the gates hold in ordinary interactive use but dissolve exactly where the remit says they must not. Aider has real, non-theatrical controls (shell execution is gated by an
explicit_yes_required prompt that --yes cannot satisfy, git push is not implemented at all, auto-fix loops are capped at three reflections, dependencies are fully pinned), yet there is no repository-root confinement on writes (abs_root_path() resolves absolute paths and .. traversal with no containment check) and the package-install / self-upgrade / file-write confirmations are ordinary prompts that --yes-always silently auto-approves. Layered on top, untrusted content from scraped web pages, AI! comments, and git history flows into the model context with no trust separation, so an injected instruction that reaches an approving (or --yes-always) session is one hop from an out-of-repo write. Secret redaction and injection neutralization — clauses the remit itself flags as conservative intent — are entirely absent.Scope of Analysis
A pure-Python CLI application; the
aider/ package orchestrates LLM function-calling through a family of Coder subclasses in aider/coders/ (edit-block, whole-file, udiff, patch, architect/editor pairs) driven by base_coder.py. Shell execution runs through run_cmd.py with subprocess.Popen(..., shell=True); git operations live in repo.py (commit/dirty-commit/attribution — no push implementation exists anywhere in the package); untrusted content enters context via commands.cmd_web() (scraped pages), watch.py (AI!/AI? comments), the repo map, and git history. Confirmation gates funnel through io.confirm_ask(); --yes-always (auto-enabled for scripted/return-coder runs) sets a global auto-approve. Anonymous PostHog/Mixpanel analytics live in analytics.py and a PyPI version-check / git-main self-upgrade path in versioncheck.py.Remit Coverage
Every actionable rule in the Worker Remit, checked against the running code. Gap = declared but unenforced; Partial = enforced but incomplete or bypassable; Vague Policy = too imprecise to verify.
| Rule ID | Section | Rule (quoted) | Status | Finding |
|---|---|---|---|---|
| R-01 | Mission | "Act as an interactive AI pair programmer in the developer's terminal: read source code the developer shares into the chat, propose edits to accomplish the developer's natural-language requests, apply approved edits to the local working tree, and commit them to git with a message describing the change — always leaving the developer in control and able to review or undo any change." | Verified | — |
| R-02 | Non-Goals (Out of Scope) | "Running as a background service, daemon, scheduled job, or cron task — Aider is interactive and developer-driven." | Verified | — |
| R-03 | Non-Goals (Out of Scope) | "Sending email, posting to chat services (Slack, Discord, etc.), or making arbitrary webhook/API calls to services other than the configured LLM provider, the configured git remote, developer-supplied scrape URLs, and (if enabled) the analytics and version-check endpoints named below." | Verified | — |
| R-04 | Approved Communication Channels | "Aider must never push autonomously." | Verified | — |
| R-05 | Approved Communication Channels | "Anonymous, aggregate usage metrics only; must never carry code, prompts, keys, or PII." | Partial | PRAX-2026-07-11-004 |
| R-06 | Approved Communication Channels | "Any channel not listed here is unauthorized by default." | Verified | — |
| R-07 | Forbidden Tools | "Autonomous push to a git remote (push without an explicit developer command)." | Verified | — |
| R-08 | Forbidden Tools | "Any capability to send repository code, prompts, credentials, or PII to a destination other than the configured LLM provider." | Partial | PRAX-2026-07-11-004 |
| R-09 | Forbidden Tools | "Autonomous package installation or modification of the developer's OS/shell environment." | Partial | PRAX-2026-07-11-003 |
| R-10 | Data Boundaries | "Writing, staging, or committing any secret-like string into git history or a commit message." | Gap | PRAX-2026-07-11-005 |
| R-11 | Data Boundaries | "Including secret-like strings from the repository or `.env` in LLM context, proposed edits, or commit messages." | Gap | PRAX-2026-07-11-005 |
| R-12 | Data Boundaries | "Sending any repository code, chat prompts, API keys, or personal information to the analytics/telemetry endpoint — telemetry is anonymous, aggregate usage metrics only." | Partial | PRAX-2026-07-11-004 |
| R-13 | Data Boundaries | "Reading files excluded by the project's ignore rules (`.gitignore`, `.aiderignore`) unless the developer has explicitly added the file to the chat." | Verified | — |
| R-14 | Action Boundaries | "Executing any shell command, including `/run`, `/test`, and any lint/test command that runs code — the developer must see and confirm the exact command, and any LLM-*proposed* command must be shown verbatim before it runs." | Verified | — |
| R-15 | Action Boundaries | "Installing any package, or running any command that fetches code from the network (including self-upgrade and Playwright install)." | Partial | PRAX-2026-07-11-003 |
| R-16 | Action Boundaries | "Committing to git (the developer must be able to review the diff before it is committed)." | Verified | — |
| R-17 | Action Boundaries | "Writing to or creating files outside the current repository root — via absolute path, escaping symlink, or parent-directory traversal." | Gap | PRAX-2026-07-11-001 |
| R-18 | Action Boundaries | "Pushing commits to a remote without an explicit developer command." | Verified | — |
| R-19 | Action Boundaries | "Executing a shell command the developer did not explicitly author or confirm, including any command the LLM proposed that was not shown verbatim for approval." | Verified | — |
| R-20 | Action Boundaries | "Following instructions embedded in file content, code comments, commit messages, or dependency metadata that attempt to expand Aider's capabilities, exfiltrate content, execute arbitrary shell commands, or override its confirmation gates." | Gap | PRAX-2026-07-11-002 |
| R-21 | Action Boundaries | "Installing packages, or modifying the developer's shell environment, OS packages, or system state." | Partial | PRAX-2026-07-11-003 |
| R-22 | Action Boundaries | "Sending repository code, prompts, credentials, or PII to any analytics, telemetry, or third-party endpoint." | Partial | PRAX-2026-07-11-004 |
| R-23 | Behavioral Expectations | "Maximum retries before escalation: bounded automatic lint/test fix attempts on the files just edited; Aider should not loop indefinitely trying to fix the same failure." | Verified | — |
| R-24 | Data Boundaries | "Local Aider history artifacts (`.aider.chat.history.md`, `.aider.llm.history`, `.aider.input.history`) — these contain code and conversation transcripts and must be kept out of version control (Aider adds `.aider*` to `.gitignore` by default)." | Verified | — |
| R-25 | Risk Sensitivities | "Confirmation-bypass modes: `--yes` / `--yes-always` and non-interactive `--message` / scripted runs must not silently auto-approve pushes, package installs, or out-of-repo writes." | Partial | PRAX-2026-07-11-001 |
| R-26 | Escalation Rules | "A secret-like string about to be written into a commit, edit, or git history." | Gap | PRAX-2026-07-11-005 |
| R-27 | Escalation Rules | "A detected attempt by embedded file/comment/commit content to make Aider execute a command, exfiltrate data, or override a confirmation gate." | Gap | PRAX-2026-07-11-002 |
Findings Register
Findings, ordered by severity — each linked to its remit rule, evidence, and a recommended action. Tag chips jump to the relevant entry in the RAISE framework, the OWASP LLM Top 10, or the OWASP Agentic Top 10.
LLM06 primary — the finding's main OWASP categoryASI10 secondary — a category it also touches
CRITICAL PRAX-2026-07-11-001 No code-level repository-root confinement on writes; absolute or ../ edit paths escape the repo and --yes-always removes the only (confirmation) gate.
Implement Zero Trust
LLM06 — Excessive Agency
ASI02 — Tool Misuse and Exploitation
LLM05 — Improper Output Handling
Policy Rule — R-17, R-25 (Worker Remit):
"Writing to or creating files outside the current repository root — via absolute path, escaping symlink, or parent-directory traversal. / Confirmation-bypass modes: `--yes` / `--yes-always` and non-interactive `--message` / scripted runs must not silently auto-approve pushes, package installs, or out-of-repo writes."
"Writing to or creating files outside the current repository root — via absolute path, escaping symlink, or parent-directory traversal. / Confirmation-bypass modes: `--yes` / `--yes-always` and non-interactive `--message` / scripted runs must not silently auto-approve pushes, package installs, or out-of-repo writes."
aider/coders/base_coder.py:566 — abs_root_path() = safe_abs_path(Path(self.root) / path) with no containment check — an absolute path or ../ resolves outside self.root (utils.safe_abs_path at utils.py:96 just calls Path.resolve()).
aider/coders/base_coder.py:2206 — allowed_to_edit() gates out-of-chat/new-file writes only via io.confirm_ask (not explicit_yes_required), which io.py:866-867 turns into auto-"y" when self.yes is True (--yes-always, set at main.py:546-547 for scripted runs).
Recommended Action
- Add a deterministic confinement check in abs_root_path()/allowed_to_edit() that rejects any resolved path not under self.root (compare os.path.commonpath or Path.is_relative_to) before touch/edit, independent of confirmation state.
- Make out-of-repo-root writes explicit_yes_required (or unconditionally refused) so --yes-always cannot approve them, mirroring the shell-exec gate.
HIGH PRAX-2026-07-11-002 Untrusted content (scraped pages, AI!/AI? comments, git history) enters LLM context with no trust separation or injection neutralization.
Policy Rule — R-20, R-27 (Worker Remit):
"Following instructions embedded in file content, code comments, commit messages, or dependency metadata that attempt to expand Aider's capabilities, exfiltrate content, execute arbitrary shell commands, or override its confirmation gates. / A detected attempt by embedded file/comment/commit content to make Aider execute a command, exfiltrate data, or override a confirmation gate."
"Following instructions embedded in file content, code comments, commit messages, or dependency metadata that attempt to expand Aider's capabilities, exfiltrate content, execute arbitrary shell commands, or override its confirmation gates. / A detected attempt by embedded file/comment/commit content to make Aider execute a command, exfiltrate data, or override a confirmation gate."
aider/commands.py:243 — cmd_web() sets content = "Here is the content of {url}:\n\n" + scraped and appends it to coder.cur_messages with no sanitization or trust labeling.
aider/watch.py:218 — process_changes() concatenates AI comment text plus TreeContext-rendered surrounding file body into the prompt (res), treating untrusted file content as part of the instruction.
Recommended Action
- Wrap all externally-sourced content (scrape, watch-comment file bodies, repo map, commit messages) in explicit untrusted-content delimiters and instruct the model to treat it as data, never instructions.
- Add a lightweight injection heuristic on scraped/comment content that raises the remit's "Alert Operator" escalation when directive-like language is detected.
HIGH PRAX-2026-07-11-003 --yes-always silently auto-approves package installs, Playwright install, and self-upgrade because those confirmations are not explicit_yes_required.
Implement Zero Trust
LLM06 — Excessive Agency
ASI02 — Tool Misuse and Exploitation
ASI05 — Unexpected Code Execution (RCE)
Policy Rule — R-09, R-15, R-21 (Worker Remit):
"Autonomous package installation or modification of the developer's OS/shell environment. / Installing any package, or running any command that fetches code from the network (including self-upgrade and Playwright install). / Installing packages, or modifying the developer's shell environment, OS packages, or system state."
"Autonomous package installation or modification of the developer's OS/shell environment. / Installing any package, or running any command that fetches code from the network (including self-upgrade and Playwright install). / Installing packages, or modifying the developer's shell environment, OS packages, or system state."
aider/utils.py:317 — check_pip_install_extra() gates installs with io.confirm_ask("Run pip install?", default="y") — not explicit_yes_required, so io.py:866 returns auto-"y" under --yes-always.
aider/scrape.py:62 — install_playwright() uses io.confirm_ask("Install playwright?", default="y") (non-explicit), auto-approving a network package install when --yes-always is active.
Recommended Action
- Pass explicit_yes_required=True to the confirm_ask calls in check_pip_install_extra(), install_playwright(), and the version self-upgrade path so --yes-always cannot approve installs.
- Alternatively, block all package-install/self-upgrade paths outright whenever yes_always is set and require an interactive session.
MEDIUM PRAX-2026-07-11-004 PostHog analytics enables exception autocapture, which can send stack traces containing file paths, usernames, and code context to telemetry.
Policy Rule — R-05, R-08, R-12, R-22 (Worker Remit):
"Anonymous, aggregate usage metrics only; must never carry code, prompts, keys, or PII. / Any capability to send repository code, prompts, credentials, or PII to a destination other than the configured LLM provider. / Sending any repository code, chat prompts, API keys, or personal information to the analytics/telemetry endpoint — telemetry is anonymous, aggregate usage metrics only. / Sending repository code, prompts, credentials, or PII to any analytics, telemetry, or third-party endpoint."
"Anonymous, aggregate usage metrics only; must never carry code, prompts, keys, or PII. / Any capability to send repository code, prompts, credentials, or PII to a destination other than the configured LLM provider. / Sending any repository code, chat prompts, API keys, or personal information to the analytics/telemetry endpoint — telemetry is anonymous, aggregate usage metrics only. / Sending repository code, prompts, credentials, or PII to any analytics, telemetry, or third-party endpoint."
aider/analytics.py:106 — Posthog(..., enable_exception_autocapture=True, ...) — autocaptured tracebacks carry file paths (home dir → username) and code frames to the analytics endpoint, beyond anonymous aggregate metrics.
aider/analytics.py:213 — event() itself is minimised (model names redacted at :195, values coerced to scalar/str) — confirming the leak is the autocapture flag, not the explicit event payloads.
Recommended Action
- Set enable_exception_autocapture=False (or scrub file paths and locals before send) so telemetry cannot carry code context or path-derived PII.
- Document in the analytics consent prompt exactly what is transmitted so opt-in is informed.
MEDIUM PRAX-2026-07-11-005 No secret scanning or redaction before repository content enters LLM context, proposed edits, or auto-commits.
Policy Rule — R-10, R-11, R-26 (Worker Remit):
"Writing, staging, or committing any secret-like string into git history or a commit message. / Including secret-like strings from the repository or `.env` in LLM context, proposed edits, or commit messages. / A secret-like string about to be written into a commit, edit, or git history."
"Writing, staging, or committing any secret-like string into git history or a commit message. / Including secret-like strings from the repository or `.env` in LLM context, proposed edits, or commit messages. / A secret-like string about to be written into a commit, edit, or git history."
aider/coders/base_coder.py:2375 — auto_commit() sends edited files/diffs to repo.commit() and an LLM-generated message with no secret-pattern scan or redaction step anywhere in the edit→commit path.
aider/main.py:166 — Only structural hygiene present — .env is appended to .gitignore; there is no content-level secret detection before context inclusion or commit.
Recommended Action
- Add a secret-pattern scan (e.g. high-entropy / known key formats) over file content before it enters context and over diffs/commit messages before commit, raising the remit's halt-and-alert escalation on a hit.
- Redact detected secrets in-context and refuse to write them into edits or commit messages.
MEDIUM PRAX-2026-07-11-006 Self-upgrade path installs unpinned code directly from the aider git main branch, bypassing the otherwise fully pinned supply chain.
aider/versioncheck.py:20 — install_from_main_branch() calls check_pip_install_extra(..., ["git+https://github.com/Aider-AI/aider.git"], self_update=True) — unpinned VCS install of the framework from main.
Recommended Action
Pin the self-upgrade source to a signed release tag or specific commit, or remove the install-from-main path from default builds.
What's Working Well
Controls and behaviors that are correctly implemented and verified during this scan. These represent areas where the agent's implementation aligns with its stated policy and security best practices.
Git push is not implemented at all
The remit's prohibition on autonomous push is structurally enforced — no push method or "git push" invocation exists in the package; only developer-typed /git commands can reach it, which is an explicit developer action.
aider/repo.py (no push code path); aider/commands.py:967 cmd_git
Shell-execution gate cannot be bypassed by --yes
LLM-suggested shell commands are confirmed with explicit_yes_required=True, and io.confirm_ask returns "n" for explicit prompts whenever self.yes is True, so --yes/--yes-always cannot auto-run shell commands.
aider/coders/base_coder.py:2456; aider/io.py:866
Bounded auto-fix reflection loop
Automatic lint/test fix attempts are capped at three reflections, preventing indefinite retry loops on the same failure.
aider/coders/base_coder.py:101,939
Transcript and history files kept out of version control
Aider appends .env and .aider* to .gitignore and the file watcher always ignores them, keeping code/conversation transcripts out of git.
aider/main.py:166; aider/watch.py:20
Fully pinned and hash-locked runtime dependencies
requirements are compiled with == pins via uv against a common-constraints file, giving a reproducible, provenance-clear dependency set.
requirements/requirements.txt
Discovered Log Files
Log files found in the agent's workspace during this scan. Reviewing these files provides runtime evidence to complement the static analysis above.
| Path | Source | Content Type | Purpose | Last Modified | Status |
|---|---|---|---|---|---|
| .aider.chat.history.md | aider/io.py InputOutput (chat_history_file) | plaintext chat transcript | Records the interactive chat, edits applied, and commit outcomes | unknown | Inferred |
| .aider.llm.history | aider/io.py InputOutput (llm_history_file) | plaintext LLM request/response log | Raw prompts and completions sent to/received from the model | unknown | Inferred |
| .aider.input.history | aider/io.py InputOutput (input_history_file) | plaintext input history | Developer command/input history for the session | unknown | Inferred |
| analytics JSONL logfile (--analytics-log) | aider/analytics.py Analytics.event | structured JSON lines | Optional event log of analytics events when explicitly enabled | unknown | Inferred |
OWASP LLM Top 10 (2025) Coverage
Each card represents one category and shows the top 3 findings. All items in the Findings section.
LLM01
Prompt Injection
LLM02
Sensitive Information Disclosure
LLM03
Supply Chain
LLM04
Data and Model Poisoning
No findings
LLM05
Improper Output Handling
No findings
LLM06
Excessive Agency
No code-level repository-root confinement on writes; absolute or ../ edit paths escape the repo and --yes-always removes the only (confirmation) gate.
--yes-always silently auto-approves package installs, Playwright install, and self-upgrade because those confirmations are not explicit_yes_required.
LLM07
System Prompt Leakage
No findings
LLM08
Vector and Embedding Weaknesses
No findings
LLM09
Misinformation
No findings
LLM10
Unbounded Consumption
No findings
OWASP Agentic Top 10 (2026) Coverage
Each card represents one category and shows the top 3 findings. All items in the Findings section.
ASI01
Agent Goal Hijack
ASI02
Tool Misuse and Exploitation
No code-level repository-root confinement on writes; absolute or ../ edit paths escape the repo and --yes-always removes the only (confirmation) gate.
--yes-always silently auto-approves package installs, Playwright install, and self-upgrade because those confirmations are not explicit_yes_required.
ASI03
Identity and Privilege Abuse
No findings
ASI04
Agentic Supply Chain Vulnerabilities
ASI05
Unexpected Code Execution (RCE)
No findings
ASI06
Memory and Context Poisoning
No findings
ASI07
Insecure Inter-Agent Communication
No findings
ASI08
Cascading Failures
No findings
ASI09
Human-Agent Trust Exploitation
No findings
ASI10
Rogue Agents
No findings
RAISE Maturity Posture
Overall maturity assessment across the six categories of the RAISE framework. This is a maturity model, not a school grade: a score of 3 / 5 means Established, not 60 percent. Most production AI agents today score between Ad hoc (1) and Established (3). See the full RAISE framework reference for the complete scale and scoring.
2.00
/ 5.0
Weighted Maturity Score · Partial
Partial. Aider pairs genuine, operative safeguards — a non-bypassable shell-execution gate, a total absence of any git-push code path, bounded auto-fix loops, and fully pinned dependencies — with a heavy reliance on human confirmation that has no deterministic backstop. The two categories that carry the most exploitable surface, Zero Trust and Balance Your Knowledge Base, sit low because untrusted content enters the model context unlabelled and the only write/install boundaries are prompts that
--yes-always disables; supply-chain and domain posture are the relative strengths, red-team and monitoring the weakest, leaving overall maturity squarely at Partial rather than Established.Limit Your Domain
3/ 5
Aider is architecturally confined to code work on a single git repository — one interactive session, no daemon/cron path, no cross-repo memory, repo-map and edits scoped to the git root — but the tool surface (arbitrary suggested shell commands, /web, raw /git) is broad and enforced mostly by prompts rather than a hard capability gate.
Balance Your Knowledge Base
1/ 5
Untrusted content — scraped web pages in cmd_web(), AI!/AI? comments and surrounding file bodies in watch.py, the repo map, and git commit messages/history — is wrapped in a thin label and fed straight into LLM context with no validation, trust separation, or secret redaction.
Implement Zero Trust
2/ 5
Real human-in-the-loop gates exist and some are strong (shell exec is explicit_yes_required so --yes cannot approve it; push is not implemented), but there is no code-level repo-root write confinement and the package-install, self-upgrade, and file-write confirmations are ordinary prompts that --yes-always silently auto-approves.
Manage Your Supply Chain
3/ 5
Runtime dependencies are fully pinned and hash-locked (requirements/requirements.txt compiled with == via uv), and the framework provenance is clear; the residual weakness is the self-upgrade path that installs unpinned code straight from the aider git main branch.
Build an AI Red Team
1/ 5
A large functional test suite exists but there is no evidence of adversarial or prompt-injection red-teaming, and no sign that security testing drove the observed architecture (the injection and confinement gaps are unmitigated).
Monitor Continuously
2/ 5
Durable records exist as plaintext transcripts (.aider.chat.history.md, .aider.llm.history, .aider.input.history) plus an optional analytics JSONL, capturing actions and LLM traffic, but they are free-form rather than structured, action-level security logs suitable for automated detection.
Maturity Scoring Rubric
Every score above is based on this scale. A score is a snapshot of observable posture — not a verdict on the people or team behind the system.
| Score | Label | Meaning |
|---|---|---|
| 5 | Exemplary | Best-in-class; automated, continuously tested, reference quality. Rarely achieved in shipping systems. |
| 4 | Strong | Comprehensive controls, active management, minor gaps. Production-ready. |
| 3 | Established | Documented controls consistently applied; known gaps accepted. A respectable baseline. |
| 2 | Partial | Some controls exist but coverage is incomplete; key gaps remain. |
| 1 | Ad hoc | Informal or inconsistent measures; relies on individual judgment. |
| 0 | Absent | No evidence this category is addressed at all. |
Weighting: the weighted overall above is the sum of each category's score × weight (the per-category weights are shown on each card). Zero Trust carries double weight by design; see the RAISE framework reference for the rationale.