The terrifying reason your AI coding agent shouldn't be allowed to run npm install (and how I fixed it)

We are officially in the era of autonomous coding. You spin up an AI agent in your terminal, give it a prompt, and watch it write code, edit files, install dependencies, and even fix its own mistakes.