Agentic development lifecycle security is exposing new supply chain risk

At a glance

What this is: Cycode argues that agentic development turns AI-generated code, autonomous dependency choice and tool use into a supply chain risk because human review and IDE-centric controls no longer cover where work now happens.

Why it matters: For IAM, PAM, NHI and AI security teams, the issue is that autonomous development creates machine-speed decision paths that need identity, privilege and guardrail controls before code reaches production.

By the numbers:

• Cycode reports that 100% of surveyed organisations confirmed they have AI-generated code in their codebase.
• Cycode reports that 81% have no visibility into how AI is actually being used across their development lifecycle.

Context

Agentic development changes the security problem from code review to governed execution. In this model, AI agents generate code, select dependencies, call tools and commit changes with limited human touchpoints, so the control surface shifts away from the IDE and into pipelines, chat workflows and orchestration layers.

That creates a genuine identity and governance issue as well as a supply chain one. The agent becomes a decision-making actor that can touch code, secrets, APIs and external services, which means teams need controls for authorisation, provenance and runtime boundaries rather than relying on manual checkpoints that assume a developer is always in the loop.

Key questions

Q: What breaks when AI agents can make code changes faster than humans can review them?

A: Manual review stops being a meaningful control if it cannot keep pace with change volume. Teams then miss unsafe dependencies, unintended privilege use, and subtle architecture drift. The failure is not only in code quality, but in the programme’s ability to detect and contain agent-driven mistakes before they reach production.

Q: Why do autonomous package installs by AI agents increase supply chain risk?

A: Autonomous installs increase risk because the approval often happens on reflex, not informed review. A malicious package can compromise the developer machine immediately, exposing credentials and tokens, while a merely risky package can enter the software bill of materials and persist as hidden technical debt. The decision point is compressed, so traditional human review controls no longer catch the risk in time.

Q: What are the signs that agentic development controls are failing?

A: The main signals are silent dependency choices, unexpected secret access, agent tool calls to services outside the approved workflow and code changes that appear without a clear human decision trail. Those patterns show the agent is operating beyond its intended boundary and that governance is happening too late to contain the risk.

Q: How should teams govern AI-assisted development workflows that use coding agents?

A: Treat them as identity-governed execution paths, not just productivity tools. Define who can start the workflow, which tools and data sources it can reach, what evidence is required for review, and how access is revoked if the workflow expands beyond its intended scope. The key is to govern the chain of delegated action, not only the final code output.

Technical breakdown

How agentic development changes the control point

In traditional SDLCs, security feedback is attached to human actions such as editing, committing and approving code. Agentic development breaks that model because the agent can generate, refactor and merge changes through CLI, APIs or chat surfaces without a developer opening an IDE. That means the control point moves from user interaction to machine execution. Security tooling now has to inspect what the agent is doing, not just what a person approves. This is why prompt-driven workflows, auto-generated pull requests and delegated tool calls need policy enforcement at the point of execution, not after review.

Practical implication: Shift controls from developer prompts to agent execution paths, with policy enforcement in the pipeline and tool layer.

Why AI supply chain risk is broader than open-source dependency risk

The article’s core point is that the software supply chain now includes AI models, MCP servers and hallucinated package names, not just third-party libraries. An agent may choose a dependency that does not exist, rely on a model version with different behaviour, or connect to an external tool through MCP that can redirect actions across the pipeline. Traditional SCA scans only see packages that already exist in manifests. They do not see phantom dependencies, compromised tool servers or model-driven decision errors before commit time. That makes AI supply chain security a distinct control problem, not a minor extension of SCA.

Practical implication: Extend supply chain controls to models, tool connectors and dependency provenance, not just known packages.

Why security has to reason about agent behaviour

Agentic pipelines create signals that are different from ordinary developer activity. A sequence where an agent reads secrets and then calls an external API is not simply usage, it can be a compromise indicator or a prompt-injection outcome. Because agent behaviour is non-deterministic, teams cannot rely only on static baselines or code diff inspection. They need telemetry that links tool calls, credential access, dependency choice and outbound actions so the security team can see whether the agent stayed inside its intended boundary. In other words, behaviour monitoring becomes part of development security, not just incident response.

Practical implication: Monitor tool-call sequences and credential access patterns as first-class security signals in agentic workflows.

Threat narrative

Attacker objective: The attacker wants to exploit autonomous development paths to insert malicious code, expand access or trigger downstream supply chain compromise at scale.

1. Entry occurs when an AI agent is allowed to generate code, select dependencies or call external tools without tight governance over what it can touch.
2. Credential or supply-chain abuse follows when the agent consumes hallucinated dependencies, untrusted MCP servers or prompt-injected instructions that alter its choices.
3. Escalation happens as those decisions propagate at machine speed across commits, pipelines and repositories, multiplying the impact of one bad dependency or one compromised tool path.
4. The end state is widespread codebase contamination, secret exposure or unauthorized workflow execution across multiple projects before human review can intervene.

Breaches seen in the wild

• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ADLC creates a governance gap, not just a tooling gap: once agents can write, choose and commit code, the old assumption that human review is the primary security checkpoint no longer holds. Security teams are no longer governing developer output alone, they are governing machine decisions that happen before a human sees the change. Practitioners should treat agent execution as a controlled identity and access problem, not only an application security workflow.

AI supply chain risk now includes the identity of the toolchain itself: models, MCP servers and orchestration layers behave like non-human participants in the delivery process. That means provenance, authorisation and boundary enforcement matter as much as package scanning. The named concept here is agentic supply chain drift, where trust assumptions move faster than the controls built to validate them. Practitioners should inventory and govern every non-human component that can influence code.

Machine-speed development breaks review-based security economics: human-paced checkpoints were designed for changes that arrive slowly enough to inspect. In ADLC, code generation, dependency selection and merge decisions can happen continuously, which compresses the time available to detect error or abuse. The practical implication is that controls need to move upstream into policy, runtime guardrails and continuous enforcement rather than relying on manual gates.

Agent behaviour monitoring belongs in product security governance: a code change is no longer the only meaningful artefact. Tool-call sequences, secret access and outbound connections can reveal misuse earlier than the code itself. That pushes security teams toward observable execution policies, where agent activity is measured against intent and approved boundaries. Practitioners should govern the behaviour path, not just the final artifact.

Agentic development is a broader identity security problem in disguise: when agents can act on behalf of humans across code, secrets and APIs, the question becomes who or what is authorised to perform each development action. That is directly relevant to NHI and agentic AI governance because the actor is non-human even when the outcome is software. Practitioners should formalise agent identity, scope and revocation before adoption scales.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Agentic supply chain drift: the most important change is that trust now moves through models, tools and dependency selection faster than traditional review can validate it. That means development security has to become continuous, policy-driven and observable at the point where an agent decides, not where a human eventually approves.

Organisations that still treat AI as a developer assist layer will miss the actual risk surface. Once code generation, tool calls and merge actions are delegated to agents, governance must cover identity, authorisation and execution boundaries across the full development path.

For practitioners

• Inventory agentic development surfaces Identify every place where AI agents can create, modify, test or merge code, including chat tools, CLIs, orchestration layers and MCP-connected workflows.
• Bind agent actions to explicit policy Define which repositories, dependencies, APIs and environments each agent may touch, and block any execution outside those boundaries.
• Add continuous supply chain validation Check model provenance, dependency legitimacy and tool-server trust before changes reach merge or deployment stages.
• Monitor agent tool-call behaviour Alert when an agent reads secrets, makes unexpected outbound API calls or requests capabilities that do not match the declared task.
• Separate human approval from machine execution Use guardrails that make human intent explicit while preventing agents from silently bypassing review, policy or logging requirements.

Key takeaways

• Agentic development exposes a security gap because code, dependencies and tool calls can now be produced by non-human actors that traditional SDLC controls were never designed to supervise.
• The article shows that the supply chain problem expands beyond packages to include model behaviour, MCP-connected tools and phantom dependencies that can be exploited at machine speed.
• The practical response is to move security into execution paths, govern agent identity and scope, and validate provenance before autonomous changes reach production.

Key terms

• Agentic Development Lifecycle: The Agentic Development Lifecycle is the control pattern for building, approving, deploying, and reviewing AI agents before they reach production. It extends software change discipline into identity governance by requiring traceability for creation, access grants, business purpose, and ongoing oversight.
• Agentic Supply Chain: The collection of models, tools, plugins, prompts, memory stores, and middleware that an AI agent depends on to operate. Weaknesses in this chain can introduce hidden instructions, poisoned context, or exposed secrets, so security teams need inventory, trust validation, and isolation controls across the entire path.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Hallucinated Dependencies: Hallucinated dependencies are fake packages, libraries, or registries that an AI model invents while trying to solve a coding task. They create real security risk because attackers can register those names on public package managers and place malicious code there, turning a model error into a software supply chain compromise.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity for practitioners who need to govern non-human actors safely. It helps security leaders connect identity controls to the broader security programme that autonomous development now depends on.