TL;DR: Backslash Security surveyed engineering and security teams in June 2026 and found 100 percent of respondents had AI-generated code in production, while 81 percent had no visibility into where or how AI was used across the development lifecycle, according to Vectra AI. That is a governance failure in the access and detection model, not simply an agent problem.
At a glance
What this is: The article argues that AI coding agents are already shipping production code, but most organisations cannot see the runtime behaviour that produces it.
Why it matters: IAM, PAM, and NHI teams need to treat agent execution like a governed identity path, because review of final code does not reveal credential use, tool calls, or cross-system movement.
By the numbers:
- 100 percent of respondents had AI-generated code running in production.
- 81 percent said they had no visibility into where or how AI was being used across their development lifecycle.
Context
AI coding agents now operate inside software delivery pipelines with real credentials, tool access, and the ability to move across repositories, CI/CD systems, and cloud environments. The governance problem is not whether the code they produce looks valid, but whether the organisation can see the identity and access behaviour behind that output.
Backslash Security’s June 2026 survey, cited by Vectra AI, shows a structural mismatch between production use and operational visibility. In practice, that means organisations are treating AI-generated code like ordinary developer output even though the execution path behaves more like a service account with chained, cross-system permissions.
The article’s core claim is that this is already a standard delivery mechanism in many environments. That makes runtime observability, permission scope, and cross-system correlation the controlling issues for both NHI governance and broader software supply-chain assurance.
Key questions
Q: Where do AI coding agents break existing identity and access controls in production pipelines?
A: They break at the point where a valid session can span repositories, CI/CD, secrets stores, and cloud resources without a single control plane seeing the whole path. The problem is not that the agent is mysterious. The problem is that normal developer controls assume one operator, one review step, and one system boundary, while the agent behaves across all three at once.
Q: Why is visibility into AI agent activity more important than reviewing the final code?
A: Because the final code does not show which packages were fetched, which credentials were touched, or which systems the agent reached while generating it. Review only covers the artifact, not the runtime behaviour. If the organisation cannot correlate those runtime actions, it cannot tell whether a valid production change came from safe execution or hidden cross-system activity.
Q: What are the signs that rogue AI governance is failing?
A: Look for unapproved tools, unknown OAuth grants, users pasting sensitive content into external services, and AI-enabled workflows that security cannot inventory or revoke. If the organisation cannot say which tools can access which data, governance is already lagging the actual exposure surface.
Q: Should organisations treat AI coding agents like privileged software identities?
A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.
Technical breakdown
How AI coding agents use credentials across the delivery path
An AI coding agent does not just suggest code. It interprets a goal, calls tools, reads and writes files, submits pull requests, runs tests, and adjusts its next step based on output. That behaviour executes under provisioned credentials, which means the agent inherits the access model of the environment it runs in. If those credentials are broad, persistent, or shared with humans, the agent’s action path becomes difficult to distinguish from legitimate operator activity.
Practical implication: treat agent execution as credentialed workload activity, not as ordinary developer assistance.
Why code review misses agent behaviour in production
Code review sees the final artifact, not the path that produced it. An agent can fetch packages, touch secrets, or call cloud services during generation, while the reviewer only sees the committed change. That leaves the behavioural evidence outside the review surface and split across repository, CI/CD, cloud, and secrets logs. No single log captures the full sequence, so normal approval workflows cannot reconstruct what the agent actually did.
Practical implication: add runtime telemetry that connects identity, tool use, and resource access across the whole development chain.
Why indicator-based detection falls short for legitimate agent activity
Threat intelligence usually matches known bad indicators such as malicious IPs, hashes, or domains. Agent activity inside a legitimate environment often has no prior signature to match, because the credential is valid and the action may align with the agent’s stated task. That creates a detection gap: the security team needs correlation across systems to understand whether a valid session behaved safely, not just whether it matched a known threat pattern.
Practical implication: build behaviour-based detection for agent sessions rather than relying on indicator matching alone.
Threat narrative
Attacker objective: The objective is to use trusted agent execution paths to reach adjacent systems and hide risky behaviour inside otherwise valid development activity.
- Entry begins with an AI coding agent operating under valid developer or workload credentials inside the development pipeline.
- Credential exposure or misuse occurs when the agent can access tokens, packages, repositories, or cloud resources that are broader than the task requires.
- Escalation happens when the agent crosses from code generation into adjacent systems such as CI/CD, secrets stores, or cloud environments without a full runtime view.
- Impact is the production of unauthorised or unreviewable behaviour that can propagate through shipped code, leaked secrets, or hidden lateral movement across development systems.
Breaches seen in the wild
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
- Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime visibility is the governing control, not code review. The article shows that AI-generated code can be shipped in production while the behaviour that created it remains outside the review surface. That breaks the assumption that approving the final artifact is sufficient to govern the execution path behind it. Practitioners need to reframe AI coding agents as runtime identities whose actions must be observable across systems, not merely reviewed at the end.
Agent execution is a service-account problem in disguise. The source is explicit that an agent runs with real credentials and provisioned permissions. That makes the access model the central control point, because a valid session can still perform unsafe work if its scope is too broad or its actions are not correlated across boundaries. The practitioner takeaway is to govern agent permissions with the same rigour used for high-risk non-human identities.
Cross-system correlation is now a baseline requirement for software delivery governance. The article’s detection narrative shows why repository, CI/CD, cloud, and secrets telemetry cannot remain isolated. A chain that is invisible within each individual system can still be obvious when the logs are correlated into one timeline. The implication is that identity governance and detection engineering now overlap in the development pipeline.
Signal gaps create inevitable detection gaps. The article is strongest when it argues that most organisations do not yet have a detection problem, they have a visibility problem. Once AI agents can act faster than human review and across more systems than any single log covers, missing signal becomes the primary failure mode. The field should treat runtime observability for agents as foundational infrastructure, not an optional enhancement.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
AI coding agent governance now depends on whether organisations can see the runtime path, not just the result. The article’s central warning is that final code review cannot reconstruct the credential use and cross-system movement that happened during generation. That is why runtime observability belongs in the same control conversation as least privilege and offboarding.
Agent behaviour should be governed as a non-human identity lifecycle. Once an agent can authenticate, call tools, and leave behind partial traces across multiple systems, it stops being a tooling feature and becomes an identity governance problem. Teams need to know who owns the agent, what it can access, and how its privileges are retired.
Visible output is not visible execution. In the broader research base, Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026. That pattern reinforces the need to measure what agents do during execution, not just what lands in the repository.
For practitioners
- Instrument agent runtime across the delivery chain Correlate repository, CI/CD, cloud, and secrets activity so each agent session can be reconstructed as one timeline rather than separate log fragments.
- Scope agent credentials to the exact task Remove write access, secrets access, and broad cloud permissions unless the agent explicitly needs them for the job it is performing.
- Audit prompt-to-action paths for code execution Review every place where user content, package data, or model output can trigger code execution or instruction parsing inside the pipeline.
- Classify agents as governed non-human identities Apply the same ownership, logging, and offboarding discipline you would use for a privileged service account.
Key takeaways
- AI coding agents create an identity governance problem because they execute with real credentials across multiple systems while review processes usually see only the finished code.
- The most serious control gap is visibility, since separate repository, CI/CD, cloud, and secrets logs do not by default show the full agent path.
- Runtime correlation, tight credential scope, and service-account style governance are the controls that matter most for this class of risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agents authenticate with real credentials, but the article shows those sessions are hard to distinguish from legitimate human use. |
| NHI-05 — Overprivileged NHI | The article stresses that agents often have more access than needed across repositories and cloud systems. | |
| NHI-10 — Human Use of NHI | The piece warns against treating AI agent activity as if normal human review can govern it. | |
| Recommendation — Apply stronger session and ownership controls to agent authentication events so valid sessions remain attributable. Restrict agent permissions to the exact systems and actions required for the task. Separate human review workflows from agent execution controls and govern the agent directly. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article describes credential harvesting and movement across development systems as the key risk pattern. |
| Recommendation — Map agent telemetry to credential access and lateral movement patterns to detect unsafe cross-system behaviour. | ||
| NIST CSF 2.0 | DE.CM-01 — Security Continuous Monitoring | The article centres on the need for continuous monitoring of agent behaviour across connected systems. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core governance issue is whether the agent's permissions match the task it is performing. | |
| Recommendation — Implement continuous monitoring that correlates agent actions across repositories, CI/CD, cloud, and secrets systems. Review and tighten agent entitlements so runtime access stays aligned to task scope. | ||
Key terms
- AI Coding Agent: An AI coding agent is software that writes, edits, reviews, or tests code with limited human prompting. It operates as an agentic system that can plan actions, call tools, and modify development artifacts, so its identity, permissions, and audit trail must be governed like any other privileged software actor.
- Trace Observability: Trace observability is the ability to inspect a workflow step by step, including inputs, decisions, retries, and outputs. For AI agents, traces show where a loop is wasting tokens, hitting permission barriers, or failing to converge. That visibility supports debugging, cost control, and post-run review.
- Cross-system Correlation: The process of joining identity data from multiple tools and environments so the combined meaning becomes visible. For identity governance, this is what turns scattered findings into a usable picture of effective access, toxic combinations, and hidden privilege.
- NHI lifecycle governance: NHI lifecycle governance is the set of policies and controls used to manage non-human identities from creation to retirement. It covers approval, issuance, rotation, monitoring, access review, revocation, and deletion for service accounts, API keys, tokens, certificates, and AI agents, so machine identities remain accountable, least privileged, and auditable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org