AI-generated code is turning AppSec into a runtime risk

At a glance

What this is: This is an analysis of how AI-generated code and agentic workflows are compressing AppSec timelines and exposing the limits of stage-gated security.

Why it matters: It matters because IAM, NHI, and broader security teams now need governance that covers developer workflows, AI supply chains, and runtime authorisation before code or agents create irreversible impact.

By the numbers:

• Of the vulnerabilities Mythos has found so far, 99% haven’t been patched, according to Gartner.
• The cost of fixing a vulnerability rises roughly 10x at every stage you wait.

👉 Read Checkmarx's analysis of AI-generated code, agentic risk, and AppSec

Context

AI-generated code changes the security problem from finding flaws to governing how quickly flaws can become exploitable. When code creation, analysis, and even exploit generation accelerate at machine speed, traditional checkpoint-based AppSec models lose their timing advantage. The same shift also affects identity governance, because AI agents and code-generation systems increasingly act with delegated access that must be controlled like any other non-human identity.

The article’s core warning is not that AI creates more vulnerabilities in theory. It is that the remediation window is shrinking while the volume of machine-generated output is growing, which makes speed of response a governance issue rather than just an engineering one. For identity and security teams, that means policy, privilege, and auditability must extend into the development lifecycle, the AI supply chain, and runtime authorisation decisions.

Key questions

Q: How should security teams govern AI agents that choose tools at runtime?

A: Security teams should treat runtime tool choice as a governed access event, not a normal application call. That means task-scoped credentials, explicit approval boundaries for sensitive actions, and logs that record both the tool selected and the identity used. If the agent can change its plan, the control model must be able to change with it.

Q: Why do AI-generated code pipelines create more security risk than traditional development?

A: They compress the time between defect creation, discovery, and exploitation. When code and exploits can be produced faster than human review cycles, the main risk is not just more vulnerabilities. It is more reachable vulnerabilities surviving long enough to become incidents.

Q: What breaks when security only happens after code is written?

A: Late-stage security turns every finding into a backlog problem and allows high-risk issues to travel into build, supply chain, and runtime environments. By then, remediation is slower, context is poorer, and the chance of exploitation is much higher. That is why stage-gated security underperforms when AI accelerates development.

Q: How do teams know whether AI governance is actually working?

A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement. If auditors can ask for a transaction and receive a complete record in hours, not weeks, the programme is producing usable control evidence rather than just documentation.

Technical breakdown

Why AI-generated code breaks stage-gated AppSec

AI-generated code increases the number of findings faster than human teams can triage them, which is why raw vulnerability counts become misleading. Stage-gated AppSec assumes there is enough time between discovery, review, and fix for manual decision-making to keep up. When exploits can be generated in minutes and code changes ship continuously, the control objective shifts from finding every issue to reducing the time a risky issue remains reachable. That is a governance problem as much as a scanning problem, because the key variable is exposure time, not just defect volume.

Practical implication: move prioritisation to exploitability and exposure window, not backlog size.

How agentic workflows create new identity and access risk

An AI agent is not just a model generating text. It is a software entity that can choose actions, invoke tools, and execute timing decisions within a delegated environment. That makes the agent a non-human identity from a governance perspective, especially when it can access repositories, pipelines, or production systems. If those permissions are persistent, the agent inherits standing privilege risk. If they are overly broad, a small prompting mistake or tool misuse can become destructive. The main failure mode is not intelligence, but uncontrolled delegation.

Practical implication: govern agents with least privilege, explicit tool scopes, and revocation paths.

Why AI supply chains need external control

The AI supply chain now includes MCP servers, agent frameworks, foundation model SDKs, and fine-tuning pipelines. These components determine what data and tools an AI system can reach, which means they shape security outcomes even when the model itself is unchanged. Governing them from inside the model is weak control design, because the system being trusted is also the system making the decision. External discovery, policy enforcement, and runtime monitoring are needed to keep AI components from expanding access beyond intended bounds.

Practical implication: inventory AI dependencies externally and enforce policy before runtime access is granted.

Threat narrative

Attacker objective: The objective is to turn fast-moving software and delegated machine access into a breach or destructive operational event before human teams can intervene.

1. Entry occurs when AI-generated code, agent workflows, or exposed credentials introduce machine-speed attack surface into the development or runtime environment.
2. Escalation happens when an agent or attacker reaches tool access, pipeline permissions, or destructive commands that were not tightly scoped to the task.
3. Impact follows when vulnerabilities remain unpatched or an agent executes unintended actions, causing code execution, data loss, or platform disruption.

NHI Mgmt Group analysis

AI-generated code has created an exposure window problem, not just a code-quality problem. When vulnerabilities can be discovered and weaponised faster than teams patch them, security programmes are no longer judged by detection volume alone. The meaningful question is how long a flaw stays reachable after discovery, which aligns directly with NIST CSF’s protect and respond functions. Practitioners should treat remediation latency as a first-class control metric.

Agentic AI must be governed as a non-human identity class. The article’s examples show why a coding agent with tool access is not just automation, but delegated authority that can create damage at machine speed. That makes identity boundaries, scoped permissions, and revocation just as important for agents as for service accounts. In NHIMG terms, this is where NHI governance and agentic AI security converge.

AI governance debt is accumulating inside the software supply chain. The article points to a growing gap between where AI systems make decisions and where security teams still try to inspect them. Model-centric controls are insufficient if MCP servers, agent frameworks, and SDKs expand access outside policy review. Practitioners should expect the centre of gravity to move toward externally governed AI dependencies and audit-ready control planes.

Fix-fast economics will reshape AppSec priorities. The 10x cost curve across lifecycle stages means teams that delay until runtime are paying a structural tax on every defect. That does not make scanning less useful, but it does make prioritisation more important than total findings. The field is moving toward attackability-driven remediation, not report-driven security.

Human oversight remains essential, but only if it is inserted at the right control point. Human review after an agent has already executed a destructive action is not meaningful control. Oversight must be embedded before privilege is granted, before tools are called, and before high-risk actions are committed. Practitioners should interpret this as a design requirement for policy enforcement, not a staffing slogan.

What this signals

Fix-fast economics will start reshaping programme budgets. Teams that still fund AppSec mainly as detection capacity will struggle as AI-generated code pushes more issues into shorter remediation windows. The strategic shift is toward controls that reduce exposure duration, not just controls that increase issue discovery. NIST SP 800-53 Rev 5 Security and Privacy Controls and the NIST Cybersecurity Framework 2.0 both reinforce this shift toward measurable protective outcomes.

Agentic AI governance will increasingly overlap with NHI management. As agents receive tool access, repository permissions, and pipeline credentials, they behave like delegated machine identities that need lifecycle control. That means inventory, scoping, rotation, and offboarding become relevant to AI operations, not just classic service accounts. The practical implication is a single governance plane for AI agents and other NHIs.

The next operational failure will not be a lack of findings. It will be the inability to decide which findings deserve immediate action while machines keep shipping new risk. Practitioners should prepare for policy-driven triage, tighter access boundaries, and audit trails that prove when an AI system was allowed to act and when it was stopped.

For practitioners

• Prioritise by exploitability, not raw vulnerability count Re-rank findings using attackability, reachability, and exposure duration so teams fix what can be used first. Tie SLA reporting to the age of reachable flaws rather than to scan volume or severity alone.
• Treat AI agents as scoped identities Assign agents explicit tool permissions, short-lived access, and revocation controls so they cannot inherit broad repository, pipeline, or production rights. Record which agent can call which tool and under what policy conditions.
• Shift controls left into the IDE and pipeline Use real-time assessment in the IDE, then hybrid scanning in build and CI/CD to reduce the number of defects that reach runtime. This shortens the window between code creation and policy enforcement.
• Inventory AI supply chain components externally Maintain an external inventory of MCP servers, agent frameworks, model SDKs, and fine-tuning pipelines, then enforce policy outside the model before runtime execution begins. Do not rely on the model to validate its own access.

Key takeaways

• AI-generated code is compressing the gap between vulnerability discovery and exploitation, which makes remediation speed a primary security control.
• Agentic workflows introduce delegated machine authority, so AI systems need the same permission discipline and lifecycle oversight as other NHIs.
• Teams should move from volume-based AppSec reporting to exploitability-based governance, because backlog size is no longer a reliable indicator of risk.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Attackability: The likelihood that a finding can be turned into a working attack in the real environment where the code or system actually runs. It combines exploitability, reachability, and exposure window, making it more useful than severity alone for prioritisation.
• AI supply chain: The AI supply chain is the full chain of models, datasets, prompts, tools, and vendors that influence a deployed AI system. It matters because trust cannot be assigned to the application alone. Practitioners need provenance, ownership, and dependency visibility to govern risk.
• Exposure Window: The period in which a credential, session, or privilege grant can be exploited before it is revoked or expires. Shorter windows help, but they do not solve the deeper question of whether the access remains justified for the full time it is active.

What's in the full article

Checkmarx's full article covers the operational detail this post intentionally leaves for the source:

• The article’s specific examples of agent behaviour that led to deletion, destruction, or other unintended actions.
• The full discussion of how Mythos changes exploit generation speed and why that matters for AppSec teams.
• The detailed breakdown of the four control points across the AI development lifecycle.
• The vendor's framing of hybrid scanning, prioritisation, and runtime feedback loops for AI workloads.

👉 Checkmarx's full article covers the four control points, remediation economics, and the AI supply-chain implications.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management. It helps practitioners connect delegated machine access to practical control design across identity programmes.