{"id":26203,"date":"2026-09-21T15:15:26","date_gmt":"2026-09-21T23:15:26","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/the-race-to-secure-ai-coding-4-steps-to-rein-agents-in\/"},"modified":"2026-09-21T15:15:26","modified_gmt":"2026-09-21T23:15:26","slug":"the-race-to-secure-ai-coding-4-steps-to-rein-agents-in","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/the-race-to-secure-ai-coding-4-steps-to-rein-agents-in\/","title":{"rendered":"The race to secure AI coding: 4 steps to rein agents in"},"content":{"rendered":"
\n
\n

The rapid adoption of AI coding agents is outpacing the security controls organizations have put in place to govern them.<\/p>\n

According to JetBrains\u2019 2025 Developer Survey, 85% of developers<\/span><\/a> now regularly use AI tools for coding and development, and 62% use at least one AI coding assistant. Gartner<\/span><\/a> projects that figure will reach 90% of enterprise software engineers by 2028.<\/p>\n

The security implications are significant. Coding agents have broad access to source code, repositories, credentials, and CI\/CD pipelines, all of which are increasingly being targeted by attackers.\u00a0<\/p>\n

Despite those risks, only 41% of organizations have a formal policy and guidelines for AI-generated code, according to JetBrains.<\/p>\n

Here\u2019s how to begin to shape the governance structures that will help you manage the risks associated with AI coding agents.<\/p>\n

[ Join webinar: <\/strong>Forrester discusses top Agentic Development Security Tools<\/strong><\/a>]<\/strong><\/p>\n

1. Treat coding agents as an insider threat<\/h2>\n

Coding agents are often seen merely as productivity tools, but they are really highly privileged insiders, said Ram Varadarajan, CEO at Acalvio.\u00a0<\/p>\n

\u201cOnce compromised through prompt injection or malicious content, they can become a direct pathway to source code theft, credentials exposure, cloud compromise, and supply chain attacks.\u201d<\/em>
\u2014<\/em>Ram Varadarajan<\/em><\/span><\/a><\/p>\n

And coding agents don\u2019t just execute predefined instructions; they can also read, interpret, and act on whatever content they encounter. That means that even an agent acting in good faith could introduce unexpected problems, said Jeff Williams, CTO at Contrast Security.\u00a0<\/p>\n

\u201cAI coding agents are not evil, but they are powerful, naive, and opaque.\u201d<\/em>
\u2014<\/em>Jeff Williams<\/em><\/span><\/a>\u00a0<\/em><\/p>\n

They are especially dangerous in development environments. Coding agents read untrusted code, documentation, tickets, comments, data files, logs, tool output, dependency metadata, and build results, Williams said. \u201cThe challenge is not simply using AI,\u201d he said. \u201cThe challenge is constraining a deputy that already has access to the software factory.\u201d<\/p>\n

Addressing those risks starts with ensuring that coding agents operate with only the access they absolutely need to do their job.<\/p>\n

2. Implement least-privilege access for coding agents<\/h2>\n

Organizations need to enforce strict access controls for coding agents because the tools often operate with broad visibility into source code, repositories, credentials, and development workflows. Limiting access to only the resources necessary for a specific task can reduce the risk of accidental exposure, misuse, or compromise.<\/p>\n

Overly broad permissions can quickly turn a coding assistant into a privileged actor inside the software delivery lifecycle, said Ryan McCurdy, vice president at Liquibase.\u00a0<\/p>\n

Agents should be able to read what they need, suggest changes, and open pull requests, McCurdy said, but they should not have standing production access, direct database credentials, or the ability to bypass approvals.\u00a0<\/p>\n

\u201cThe pipeline should be the control point, not the agent.\u201d<\/em>
\u2014<\/em>Ryan McCurdy<\/em><\/span><\/a><\/p>\n

The most effective control is enforcing least privilege programmatically rather than relying on the model to make security decisions, said Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs.\u00a0<\/p>\n

\u201cLLMs are non-deterministic by nature, which means they can be influenced by prompt injection or malicious context.\u201d<\/em>
\u2014<\/em>Jacob Krell<\/em><\/span><\/a>\u00a0\u00a0<\/em><\/p>\n

Security boundaries should be enforced through external controls such as permission systems, allowlists, parameter validation, and policy engines that cannot be bypassed through conversation alone.<\/p>\n

Don\u2019t just give a coding agent developer access and hope for the best, Williams said.\u00a0 Least privilege has to be task-specific: one repo, one branch, one job, one set of approved tools, and short-lived credentials, said Williams who is also one of the founders of OWASP.\u00a0<\/p>\n

Read-only should be the default for agents. If the agent writes code, he said, it should create a branch and open a pull request and not be allowed to commit the code to main or to approve its own pull requests, change CI\/CD, retrieve production secrets, or deploy.<\/p>\n

\u201cZero trust was about admitting the network perimeter was dead. Coding agents force us to admit the development perimeter is dead. Once an agent is inside, reading untrusted code, tickets, docs, logs, and tool output, you can\u2019t treat the dev environment as trusted anymore. You have to re-establish trust around every action the agent takes.\u201d<\/em>
\u2014Jeff Williams<\/em><\/p>\n

3. Augment \u2014 don\u2019t dump \u2014 traditional AppSec practices<\/h2>\n

Organizations using coding agents still need traditional application security practices because AI-generated code can contain the same vulnerabilities, logic flaws, and insecure configurations as code written by humans. Security testing, code review, dependency analysis, and secrets scanning remain essential for identifying issues before software reaches production.<\/p>\n

However, organizations need to augment traditional AppSec programs with controls tailored to AI coding agents, including safeguards against prompt injection, model manipulation, excessive permissions, hallucinated dependencies, and unauthorized access to sensitive code, data, and development infrastructure.<\/p>\n

Traditional AppSec is necessary, but not sufficient, Williams said. \u201cCoding agents change the problem because tools are now making changes, and humans are trying to keep up,\u201d he said.<\/p>\n

Security teams need governance for the agent itself: which repos it can touch, which tools it can invoke, which changes require approval, what evidence it must produce, and who is accountable when it makes a bad change.\u00a0<\/p>\n

\u201cThe old question was, \u2018Did this code pass the scanner?\u2019 The new question is, \u2018Should this agent have been allowed to make this change at all?\u2019\u201d<\/em>
\u2014Jeff Williams<\/em><\/p>\n

Organizations should develop policies to define what agents are allowed to do, and the technological enforcement of those policies should happen outside of the agentic system, said Noelle Murata, chief operating officer at Xcape.\u00a0<\/p>\n

Enable monitoring into agent operations to determine what additional controls or prompt adjustments are needed to corral potentially rogue or drifting agents.<\/p>\n

\u201cContinuous testing against a gold standard of behavior should be a key part of the CI\/CD pipeline. These test suites should include both \u2018happy path\u2019 and \u2018not-happy path\u2019 tests for additional robustness.\u201d<\/em>
\u2014Noelle Murata<\/em><\/p>\n

Vineeta Sangaraju, AI research engineer at Black Duck, recommends implementing continuous AI observability in the form of prompt-to-output mapping, version control, decision boundaries for AI agents and their tools, and limited agency for high-risk agents, for example.\u00a0<\/p>\n

\u201cThe challenge is that coding agents operate with varying degrees of autonomy and can influence multiple stages of the software delivery lifecycle. As a result, organizations need both traditional application security controls and AI-specific observability and governance to create an auditable and accountable development pipeline.\u201d<\/em>
\u2014<\/em>Vineeta Sangaraju<\/em><\/span><\/a><\/p>\n

4. Treat all agent-affected code as untrusted<\/h2>\n

Coding agents can be extremely quick at generating code, but that doesn\u2019t always translate into correct, secure, or production-ready output. This is especially the case when the code contains complex logic, ambiguous requirements, or security-sensitive functions.<\/p>\n

A CodeRabbit analysis<\/span><\/a> last December of 470 real-world pull requests showed that AI-generated code introduced 1.7 times more issues overall than human-written code. Logic and correctness problems occurred 75% more frequently than with human-written code, and security vulnerabilities were two times more prevalent.\u00a0<\/p>\n

Another study, by Aikido<\/span><\/a>, showed that about 20% of LLM-generated code referenced non-existent and completely hallucinated packages, leading to a new class of typosquatting attacks that some have begun referring to as \u201cslopsquatting.\u201d<\/p>\n

Contrast Security\u2019s Williams advises treating agent-written code like code from a very fast, very confident junior developer. \u201cIt might be useful, but it should not be trusted by default.\u201d\u00a0<\/p>\n

Every code change, such as a commit or pull request update, should go through security testing, secrets detection, dependency review, and policy checks. Extra scrutiny is needed around authentication, authorization, crypto, command execution, file access, secrets, logging, data access, and CI\/CD, Williams added. \u201cBackdoors are extremely difficult to detect. They can look like refactors, helpers, test changes, and small relaxations of security checks,\u201d he said.<\/p>\n

Move to zero trust for all AI coding agents<\/h2>\n

Liquibase\u2019s McGurdy said such scrutiny is especially critical at the database layer. \u201cAn agent can generate a schema or data change that looks valid but still drops a critical column, deletes production data, weakens a constraint, exposes sensitive data, or creates drift between environments,\u201d he said.\u00a0\u00a0<\/p>\n

Traditional code scanning may not always catch these issues because the risk is not always in the application code but in the structure and integrity of the underlying data, McGurdy said. \u201cThe right model is zero trust for AI-assisted development. Do not assume the agent\u2019s output is safe because it looks right,\u201d he said.\u00a0<\/p>\n

Organizations should verify the code and route AI-driven changes through governed pipelines. Also key are policy checks, separation of duties, audit evidence, and monitoring for drift, McGurdy said.<\/p>\n

The only assumption should be that every line of agent-generated code is untrusted until proven otherwise, requiring rigorous review, automated security testing, provenance tracking, and independent validation before it reaches production, said Acalvio\u2019s Varadarajan.<\/p>\n

\u201cThere\u2019s also the cold reality that complex systems are ultimately unverifiable. If we want AI safety and security, we also have to implement model-aware defense-in-depth. Mere code verification presents false comfort today.\u201d<\/em>
\u2014Ram Varadarajan<\/em><\/p>\n

The strongest defenses don\u2019t rely on the agent making the right decision, Varadarajan said. \u201cThey enforce hard system boundaries that separate instructions from untrusted data, sandbox tool access, verify every action against policy, and prevent sensitive information from flowing to unauthorized destinations,\u201d he said.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

The rapid adoption of AI coding agents is outpacing the security controls organizations have put in place to govern them.According to JetBrains\u2019 2025 Developer Survey,85% of developersnow regularly use AI tools for coding and development, and 62% use at least one AI coding assistant.Gartnerprojects that figure will reach 90% of enterprise software engineers by 2028.The security implications are significant. Coding agents have broad access to source code, repositories, credentials, and CI\/CD pipe<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26203","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26203"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26203\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26203"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}