Aider

Aider runs as the user who launched it and makes no attempt to narrow that authority. The LLM API keys it is given are written into its own process environment, and every command it runs (approved shell commands, lint and test commands) inherits that full environment, including any cloud or Git credentials the user has. There is no authorization layer in code; the only boundary is the human approval prompt for shell commands, which is scored under approval gates. The credentials aider itself holds are LLM provider keys, so a hijack mostly risks spend and whatever the user's shell can reach.

Shell commands proposed by the model are shown verbatim and need an explicit yes for each batch; even the --yes-always flag cannot approve them. File edits work differently: once a user adds a file to the chat, the model's edits to it are applied with no further prompt (then auto-committed to git so they can be undone), and new or out-of-chat files only show the path, not the change. The big gap is that configuration files in the repository being worked on (.aider.conf.yml, .env) are loaded automatically and can set a test command with auto-test, a lint command, a --load command file, or yes-always, which run commands or approve prompts with no human in the loop.

Aider's actions are text edits to files and model-suggested shell commands. Edit targets are resolved against the repo root and files ignored by git are skipped, but there is no containment check that keeps paths inside the repo (paths outside only trigger a confirmation). Shell commands are passed to the user's shell unchanged with no validation. Read-only 'ask' mode exists, but the default mode includes both file writes and shell suggestions.

Every command aider runs (approved shell commands, the automatic flake8 lint, configured test and lint commands) runs directly on the host as the user, with no sandbox and with the full environment. The project ships a Docker image that runs aider as a non-root user, which contains these commands to the mounted project folder, but it is an opt-in installation method with full network access and the API key passed in. One default execution path is not confined.

Aider reads untrusted text from the repository (files, repo map), web pages the user adds, and command and lint output, and inserts it into the conversation as user-role messages, with file contents explicitly labelled as trusted. Nothing distinguishes these sources. A hijacked model cannot fetch URLs or run shell commands without the user's explicit yes, but it can silently rewrite any file already in the chat. The decisive gap is the repository itself: an attacker who controls a repo the user opens can configure commands that run automatically (auto-test, --load, and a further default path), giving unattended code execution with the user's credentials and network.

Aider has no long-term memory and does not reload past chats unless asked, but it automatically loads configuration from the repository being edited: .aider.conf.yml, .env (overriding existing environment variables), and model settings files, with no trust prompt. These files can set commands that run automatically, auto-approve prompts, redirect the API endpoint (sending the user's API key to an attacker), or disable TLS verification. The model cannot easily write these files itself because new files and files outside the chat need confirmation and .aider* is gitignored after first run, but a cloned repository can ship them.

Aider has no plugin, skill or MCP system and never loads tools or code chosen by the model or by the repository. The only runtime installs are aider's own optional extras (help, browser, Playwright, provider SDKs), pinned in its requirements files, installed only after a 'Run pip install?' prompt showing the exact command. These are the project's own dependencies and are out of scope here, so this criterion's surface is treated as absent.

API keys come from environment variables, .env files or command-line flags, and are placed into the process environment where every command aider runs can read them. Only the OpenAI and Anthropic keys are masked, and only in the echoed command line and settings dump. The OpenRouter key obtained via OAuth is appended in plain text to ~/.aider/oauth-keys.env without restricting file permissions. Analytics are off unless the user accepts a prompt, but a full unredacted transcript is written to the repository folder by default.

By default aider appends a Markdown transcript of each session (user input, model replies, commands run, confirmation answers) to .aider.chat.history.md in the repository, and every AI edit becomes a git commit tagged with a 'Co-authored-by: aider' trailer. This gives a usable record, but it is unstructured, lives inside the workspace where it can be edited, and if writing fails aider prints a warning and continues without logging.

Each user message triggers at most one model reply plus three automatic retries for lint, edit or file-add follow-ups, and each model request has a 10-minute timeout, so aider is human-paced by design. There is no spend limit (cost is only displayed), no session time limit, and commands run with no timeout. Ctrl-C interrupts the model reply and a second Ctrl-C exits; a running command receives the interrupt through the terminal.