TL;DR: AI coding agents can read, plan, test, and ship code in one session, compressing SDLC cycles faster than human review can follow, according to Fiddler. The real governance issue is not whether agents belong in the lifecycle, but whether teams can observe and control the sensitive data and tool calls that move through it.
At a glance
What this is: This is Fiddler's analysis of how AI coding agents compress SDLC phases and create an oversight gap when teams cannot see or control what the agent does in flight.
Why it matters: It matters because security teams need governance that operates before code, data, or tool outputs leave the request path, not just after a commit or log entry appears.
Context
The SDLC was designed for human-paced work, with clear phases, handoffs, and review points. AI coding agents challenge that assumption by collapsing design, development, testing, and even pull-request creation into a single run, which weakens the old idea that review can reliably catch everything after the fact.
The security issue is not simply automation. It is the loss of usable visibility at the moment sensitive data, tool calls, and code changes move through the lifecycle. That creates a governance problem for software teams, and it has a direct identity angle where agents touch secrets, customer data, tokens, and external tools.
Key questions
Q: What breaks when AI coding agents are added to the SDLC without inline controls?
A: The review model breaks first. Agents can move from plan to code to test to handoff before a human can inspect the chain, so after-the-fact review only explains exposure instead of preventing it. Security teams need enforcement where the request is made, not just where the output is stored.
Q: Why do AI coding agents create more data exposure risk than chatbots?
A: Because they can inspect repository context, read terminal output, and retrieve nearby files without the user manually pasting everything. That broader reach means the agent can surface secrets or sensitive records the developer did not consciously select, so the main control problem becomes limiting what the agent can reach.
Q: What signs show that agent oversight is failing in development workflows?
A: A common sign is when teams can describe a leaked item only after it appears in telemetry, but cannot say where the agent picked it up or whether it was redacted before egress. Another signal is when agent-side logs and gateway logs tell different stories, which means the control view is incomplete.
Q: How should organisations govern AI coding agents in the SDLC?
A: Treat them as privileged non-human identities with named owners, narrow task scope, and explicit offboarding. Governance should align access to the exact development activity, not to a broad team role or permanent environment trust. That is the difference between using the agent safely and leaving it as an unowned execution path.
Technical breakdown
Why SDLC phase compression changes governance
The SDLC separates work into phases so organisations can manage scope, quality, and risk across predictable checkpoints. AI coding agents compress those checkpoints by performing analysis, coding, testing, and handoff work in one continuous session. That matters because the control model built for sequential human review assumes changes are observable after each handoff. When one system can complete multiple phases before a person can inspect the chain, the lifecycle still exists, but the governance boundary moves from release-time review to request-time control.
Practical implication: Treat agent runs as governed transactions, not just code generation events, and place controls where the request is made.
Observability versus control in agentic SDLC workflows
Observability shows what happened after the fact. Control decides whether a request should proceed at all. In agentic SDLC workflows, this distinction matters because logs, traces, and post-run reviews can describe exposure only after sensitive data has already moved. A request can pull context from files, tools, or databases, and the resulting output may already contain secrets, customer data, or other regulated content before a reviewer sees it. That makes inline policy enforcement the more important control point than retrospective inspection.
Practical implication: Move sensitive-data decisions into the request path so redaction or blocking happens before data reaches logs, traces, or commits.
MCP and tool calls expand the attack surface inside the lifecycle
Coding agents do not just generate text. They invoke tools, query services, and pass intermediate context through systems such as Model Context Protocol servers and connected APIs. Each call can import data into the agent's working context, where it may later be echoed into code, logs, or exported telemetry. The risk is not limited to prompt injection. Ordinary task execution can carry PII, PHI, or secrets into places they were never meant to reach, which turns the agent runtime into a data-handling environment that needs access, filtering, and redaction controls.
Practical implication: Classify every tool-connected agent as a data-handling workflow and control its inputs, outputs, and context exposure accordingly.
Threat narrative
Attacker objective: The attacker objective is to cause sensitive data or secrets to be exposed through the agent workflow and persist in places the organisation did not intend to disclose them.
- Entry occurs when an AI coding agent is given access to code, tools, and connected services in order to complete a software task.
- Credential or data access follows when the agent queries a database, file store, or MCP-connected service and pulls sensitive material into its working context.
- Impact occurs when that sensitive material is written into a log, trace export, or commit, creating exposure outside the intended boundary.
Breaches seen in the wild
- CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic coding turns SDLC oversight into a request-time governance problem: once design, development, testing, and handoff happen in one agent session, the old assumption that review can catch everything after the fact no longer holds. The lifecycle still matters, but the control point shifts from end-of-phase inspection to live policy enforcement. Practitioners should therefore treat agent execution as a governed security boundary, not a productivity feature with optional oversight.
Visibility without inline control is insufficient: telemetry can explain what an agent did, but it cannot prevent data from moving once the request is already in flight. That is the core failure mode here, and it applies equally to secrets, customer records, and other sensitive spans that agents may encounter while completing a task. Security programmes need both agent-side context and gateway-side enforcement if they want to reduce exposure rather than document it.
SDLC compression creates governance debt: the faster agents move through build and test workflows, the more existing review and sign-off models lag behind the real risk. The problem is not that agents write code, but that they can move sensitive data through connected tools faster than lifecycle controls were designed to observe. The practitioner implication is to redesign controls around runtime decisioning, not around human inspection alone.
Model Context Protocol enlarges the trust boundary around software delivery: once an agent can call tools and absorb external responses mid-task, the SDLC is no longer just a code process. It becomes an identity and access problem because the agent is acting through credentials, services, and data paths that need governance. NHI and agentic AI programmes should therefore align lifecycle controls with access scope, data minimisation, and auditability.
What this signals
SDLC compression raises the value of control at the point of execution: if an agent can move through build and test faster than a reviewer can follow, then the meaningful security decision happens before data leaves the request path. Security programmes should assume that the review layer is now downstream of the highest-risk moment.
AI coding agents create a new governance debt for lifecycle teams: the classic SDLC still describes the work, but it no longer describes the speed of execution. That mismatch will keep widening unless organisations move sensitive-data controls into the same runtime layer where agent tool calls are made.
Request-time policy becomes the practical boundary for agentic software delivery: when tools, prompts, and external data all converge inside one session, the control question is not whether the agent is useful. It is whether the organisation can constrain what enters the context, what leaves it, and what gets written back into the software supply path.
For practitioners
- Implement inline request-path enforcement Apply allow, redact, or block decisions before agent traffic reaches logs, traces, or commits, so sensitive spans never egress in the first place.
- Separate observability from governance Use telemetry to reconstruct agent behaviour, but do not rely on telemetry alone to stop exposure after the fact.
- Classify agent tool calls as data-handling events Treat database queries, MCP calls, and file reads by coding agents as governed inputs that can import secrets or personal data into runtime context.
- Redact sensitive data by default Make redaction the default response for PII, PHI, and secrets, and reserve full blocking for prompt injection or other conditions that require hard stop.
- Join agent-side and gateway-side telemetry Correlate session context, tool usage, requests, responses, and cost so reviewers can see both what the agent intended and what the platform actually processed.
Key takeaways
- AI coding agents collapse multiple SDLC phases into a single session, which makes end-of-cycle review too slow to serve as the primary control.
- The central risk is not only code generation speed, but sensitive data moving through agent context into logs, traces, or commits.
- Security teams need request-time enforcement, telemetry correlation, and default redaction to govern agentic delivery safely.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Agent tool calls are central to the article's risk of sensitive data moving through connected services. |
| ASI03 — Identity & Privilege Abuse | The article shows agents operating through credentials and access paths that need governance. | |
| ASI09 — Human-Agent Trust Exploitation | The oversight gap arises when teams trust agent output more than the runtime path that produced it. | |
| Recommendation — Constrain tool use and inspect agent actions so tool calls cannot import or leak sensitive context unchecked. Limit agent privileges to the minimum required and monitor for access that exceeds task scope. Verify agent output with inline policy and human review only after the data path has been constrained. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on controlling what the agent can access while executing software tasks. |
| PR.DS-01 — Data-at-rest is protected | Sensitive data may be written into logs or commits, making data protection a core concern. | |
| Recommendation — Apply access entitlement controls to agent workflows so tool and data access stays task-scoped. Protect sensitive data paths so agent output cannot persist unredacted in stored artefacts. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | Coding agents and connected services authenticate to each other through tool and gateway paths. |
| Recommendation — Use service authentication controls to restrict and verify agent-to-tool interactions. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article describes sensitive-data exposure through agent workflows and downstream artefacts. |
| Recommendation — Map agent data exposure paths to credential access and exfiltration tactics in detection and review workflows. | ||
Key terms
- SDLC Oversight Gap: The mismatch between how quickly software changes move through development and how slowly humans can inspect them. In AI-assisted workflows, that gap appears when one agent session can complete several phases before a reviewer can understand what happened, creating a governance problem rather than just a productivity change.
- Request-Time Control: A security control that evaluates and constrains a task before data or actions are allowed to proceed. For agentic workflows, this is the practical boundary where policy can redact, block, or scope sensitive activity before it reaches logs, commits, or external services.
- Agent Context Protocol: An agent context protocol is a communication layer that lets AI agents exchange structured context, permissions, and task data with other systems or agents. It creates a shared operational surface for memory and tool use, which makes access control, authentication, logging, and context validation critical to safe deployment.
- Tool-Connected Agent: An AI system that can call external tools, APIs, or data sources as part of its runtime behaviour. Once a tool-connected agent is in play, prompt leakage can reveal not just text instructions but the operational map of what the system can reach and execute.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners build the control model needed for modern identity-driven security programmes.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org