AI coding agents need security controls at generation time

At a glance

What this is: AI coding agents widen AppSec exposure because they can act inside the development environment, and the key finding is that controls need to operate at generation time, not only after code is committed.

Why it matters: This matters because IAM, NHI and developer-security teams now have to govern agent credentials, tool access and action boundaries before the agent can write, run or fetch unsafe material.

Context

AI coding agents are no longer limited to suggesting snippets. They can browse, read local files, execute commands, call APIs and install packages, which means the security boundary has moved from static code output to agent behaviour inside the developer workflow. That creates a governance gap because conventional AppSec checks often begin after the risky action has already happened.

The identity angle is real here: these agents operate with the developer's credentials, tool access and environment permissions, so they behave like non-human actors inside software delivery. When that access is broad and unmonitored, the question is not whether code scans exist, but whether the agent itself is constrained well enough before generation starts.

Key questions

Q: How should security teams prevent AI coding agents from making unsafe changes at generation time?

A: Put policy checks at the moment the agent acts, not only after code is written. Limit tool access, require approval for high-risk actions, and block unsafe prompts, unvetted servers and forbidden commands before they can alter code, credentials or infrastructure. That shifts control from post-hoc detection to pre-execution governance.

Q: Why do AI coding assistants increase AppSec governance risk?

A: They increase risk because they optimise for speed and plausible output, not for context-aware security validation. In practice, that means developers can accept more code with less scrutiny, which raises the chance of vulnerable functions, exposed secrets, and compliance failures entering the repository and CI/CD pipeline.

Q: What are the signs that an AI coding agent is crossing from helpful automation into unsafe execution?

A: Look for command execution that does not match the visible approval, file writes outside the intended workspace, unexpected skill or MCP server installation, and autonomous changes to config or database targets. A second warning sign is when the agent starts resolving names from sources you did not explicitly trust. Those patterns indicate the agent is acting on manipulated context.

Q: Should organisations rely on code scanning alone to secure AI-generated code?

A: No. Scanning is essential, but it is a detection layer, not a primary control. If the agent can already inject secrets, unsafe dependencies or destructive commands into the workflow, the organisation is correcting damage after the fact. Prevention has to start with agent access, tool trust and generation-time policy enforcement.

Technical breakdown

Why generation-time controls matter for AI coding agents

AI coding agents operate inside an execution context, not just an editor. They can read files, issue commands, invoke tools and fetch external content, so security has to evaluate the action before it is performed. Traditional SAST and dependency scanning still matter, but they inspect artefacts after risky behaviour may already have occurred. In agentic development, the control point shifts to policy enforcement, tool vetting and context shaping at runtime. That is why the real security boundary is the session in which the agent is allowed to decide, not just the code it eventually commits.

Practical implication: Practitioners should move controls to the point where the agent is about to act, not only where code is reviewed later.

How prompt injection and malicious MCP servers change the threat model

Prompt injection turns ordinary content, such as a README, web page or API response, into a control channel for attacker instructions. A malicious Model Context Protocol server can do something similar by feeding the agent untrusted guidance or access paths while appearing legitimate to the workflow. The result is not merely bad code generation. It is delegated execution through a trusted development assistant. This is an identity and authorisation problem as much as a code quality problem, because the agent is acting with the developer's privileges and tool access.

Practical implication: Treat connected tools and content sources as trust boundaries and block unvetted MCP servers before they can influence agent decisions.

Why secrets and insecure dependencies spread so easily through generated code

Generated code can look plausible while still embedding hardcoded secrets, deprecated APIs or vulnerable packages. Because AI assistants operate at speed and scale, these defects can propagate across many files before anyone notices. That makes background scanning useful, but not sufficient on its own. The deeper issue is that the organisation has allowed insecure patterns to enter the development path at the moment they are created. Once that happens, remediation becomes a clean-up exercise rather than prevention. Security teams need to stop treating generated code as inherently reviewable after the fact.

Practical implication: Apply real-time checks for secrets, dependency risk and unsafe patterns during generation, then re-scan continuously as code evolves.

Threat narrative

Attacker objective: The attacker wants to turn a trusted development assistant into a covert execution path that exposes secrets, alters code and increases the chance of shipping unsafe software.

1. Entry occurs when a developer gives an AI coding agent broad access to the codebase, terminal, credentials and network.
2. Credential and instruction abuse follow when malicious prompts, unsafe MCP servers or poisoned content steer the agent toward destructive or sensitive actions.
3. Impact lands when the agent leaks secrets, installs vulnerable dependencies or executes unintended commands before the issue is caught in review.

Breaches seen in the wild

• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.
• PocketOS database deletion incident: An AI coding agent found an over-privileged Railway API token in the codebase and deleted PocketOS production data and backups in nine seconds.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Generation-time control is now the right security boundary for AI coding agents. Once an agent can browse, execute commands and call tools, post-commit scanning is only a backstop. The organisation is no longer governing a static code artefact, it is governing a non-human actor inside the build path. Practitioner conclusion: move policy checks to the moment the agent decides to act.

AI coding agents create an identity and authorisation problem, not just an AppSec problem. The agent inherits the developer's trust context, then expands it through tools, APIs and external content. That makes agent permission scope, session trust and connected MCP servers the real governance surface. Practitioner conclusion: treat agent access as privileged delegated access, not as harmless automation.

Prompt injection is the clearest named concept in this category. It is the point where untrusted text becomes executable intent inside the agent workflow, often without the developer noticing. That is why the security model has to validate content sources, tool connections and action intent before execution. Practitioner conclusion: assume any external content can become an instruction channel until it is policy checked.

Continuous scanning is necessary, but it cannot be the primary control. The article shows that secrets, insecure dependencies and unsafe patterns can already be written before the scanner sees them. That means detection must be paired with preventive controls at generation time, or the organisation simply produces faster-to-find vulnerabilities. Practitioner conclusion: reduce what the agent is allowed to do, then scan what remains.

Code generation security is becoming part of identity governance for software delivery. As coding agents become embedded in IDEs and workflows, governance has to cover who or what can instruct the agent, what tools it can reach, and what output it is allowed to produce. Practitioner conclusion: align AppSec, IAM and platform engineering around agent control, not siloed review steps.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Generation-time governance is the new control plane for AI-assisted software delivery. Once an agent can write, run and fetch on behalf of a developer, review-only AppSec is too late to stop the first bad action. Teams need to decide which actions the agent may take before the session starts, not after a commit lands.

Prompt injection will remain the most useful named concept for this risk category. It explains how ordinary content becomes a control path for the agent, which is why untrusted instructions, unvetted tools and broad credentials must be treated as one connected exposure surface.

Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026. That pattern shows why generation-time controls matter more than after-the-fact review when coding agents are part of the workflow.

For practitioners

• Enforce generation-time policy controls Block unsafe actions while the agent is still making decisions, rather than waiting for code review or CI to catch the result later.
• Vet every connected MCP server Create an allowlist for Model Context Protocol servers, assess their reputation and block unapproved servers from influencing agent behaviour.
• Limit developer credential exposure to the agent Scope the agent to the minimum credentials, APIs and filesystem paths required for the task so a prompt injection cannot reach everything the developer can.
• Scan generated code before commit Run real-time checks for hardcoded secrets, vulnerable dependencies and insecure patterns while the agent is writing code, not after merge.
• Log agent actions with context Capture what the agent touched, which tool it invoked and why the workflow allowed it, so security teams can investigate manipulations and unsafe behaviour.

Key takeaways

• AI coding agents are changing the security boundary from committed code to live generation-time behaviour, which means risky actions can happen before standard review ever begins.
• Secret leakage, unsafe dependencies and unapproved tool use are now workflow problems as much as code-quality problems, because the agent acts with delegated access.
• The most effective control point is before the agent executes, which makes tool trust, policy enforcement and scoped credentials more important than scanning alone.

Key terms

• AI Coding Agent: An AI coding agent is software that writes, edits, reviews, or tests code with limited human prompting. It operates as an agentic system that can plan actions, call tools, and modify development artifacts, so its identity, permissions, and audit trail must be governed like any other privileged software actor.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Generation-Time Security: A control approach that inspects and constrains code while an AI agent is writing it, rather than waiting for post-commit review or CI scanning. It matters because AI-assisted development can create insecure patterns and secret exposure at machine speed, before traditional controls can respond.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps practitioners connect identity control to the broader security decisions their programmes now face.