TL;DR: Claude Code Security is strong pre-deployment analysis for AI-assisted coding, but it stops at the codebase and cannot see what agents do once they are live, leaving credentials, vault access, and non-human identities outside its view, according to Entro Security. Shift-left scanning without runtime NHI visibility creates a false sense of coverage.
At a glance
What this is: This is an analysis of Claude Code Security as a pre-deployment control that improves code scanning but does not address runtime behaviour of AI agents and non-human identities.
Why it matters: It matters because IAM, PAM, and NHI programmes need runtime visibility and governance for agent actions, not just earlier vulnerability detection in code.
Context
Claude Code Security sits in the shift-left layer, where code is checked before it runs. That model can reduce vulnerable code entering production, but it does not answer the governance question that matters most once AI agents are active: which non-human identities exist, what they can reach, and what they actually did at runtime.
The article’s central point is that AI coding adoption changes the identity problem, not just the development workflow. Once agents can create processes, touch systems, and access vaults, security teams need visibility into runtime identity behaviour as a separate control plane, not an extension of static code review.
Key questions
Q: What breaks when AI coding tools are governed only with pre-deployment scanning?
A: Runtime behaviour goes unseen. Static analysis can reduce vulnerable code, but it cannot show which credentials an agent used, what vaults it accessed, or whether it created non-human identities during execution. That leaves security teams with a partial control plane that looks complete only until the agent is live.
Q: Why do AI assistants create more credential risk than traditional developer tools?
A: They often aggregate access to many external services in one workflow, then persist those credentials in predictable local files or sync them into shared environments. That concentration increases blast radius. A single compromise can expose code repositories, chat, cloud projects, and databases instead of just one application boundary.
Q: How can teams tell whether AI oversharing controls are actually working?
A: They should measure whether realistic prompts produce restricted answers, redactions, or blocks when policy should apply. If the assistant still returns sensitive context under common follow-up questions, the control is not effective. Effective governance changes the response the user sees, not just the log entries security teams review.
Q: Should organisations treat AI coding agents as part of IAM and PAM governance?
A: Yes, when those agents can act on code, data, or tools in ways that affect production risk. Their permissions should be scoped, reviewed, and audited like other privileged systems, especially when they interact with sensitive routes, secrets, or regulated data. The governance question is who can let the agent act, and under what policy.
Technical breakdown
Pre-deployment code scanning versus runtime identity control
Claude Code Security is a shift-left capability: it analyses code before deployment and flags vulnerabilities through contextual reasoning rather than simple pattern matching. That is valuable for reducing insecure code paths, but it only sees artifacts that exist before execution. Once an agent runs, the control boundary changes. Runtime identity questions involve issued credentials, accessed systems, and the sequence of actions taken by the agent, which no pre-commit or pre-deploy scanner can observe. The practical gap is not detection quality in code review. It is the absence of telemetry and policy enforcement for live non-human identities.
Practical implication: treat code scanning as an input to runtime governance, not a substitute for it.
Why AI coding tools create non-human identity exposure
The article ties AI-assisted development to non-human identities because agents do more than suggest code. They can execute tasks, create processes, and interact with systems during development and in production-like environments. That means access is no longer limited to a human developer’s session. Service accounts, API keys, tokens, and other secrets can be created, reused, or touched by software acting on behalf of software. The governance challenge is therefore lifecycle-based as much as preventive: inventory, scope, and visibility have to extend to agent-generated identities and the credentials they use.
Practical implication: map every agent workflow to the non-human identities it can create, reuse, or access.
Shift left only works when it is paired with shift right
The article frames a familiar lesson from application security: earlier detection helps only when it is paired with runtime oversight. Shift left without shift right moves problems earlier in the lifecycle but leaves production behaviour unobserved. For AI tooling, that means static review can tell you whether code is likely to be vulnerable, while runtime monitoring tells you whether an agent is reaching vaults, creating secrets, or exercising access beyond expectation. This is the difference between prevention and governance. The latter is what closes the blind spot around live agent activity.
Practical implication: connect pre-deployment findings to runtime monitoring, identity telemetry, and access controls.
Threat narrative
Attacker objective: The practical objective is to operate through unseen runtime identity activity so that AI-assisted workflows can access systems and credentials beyond static review coverage.
- Entry occurs through legitimate adoption of an agentic coding assistant that can write and execute code in the development workflow.
- Credential exposure follows when the agent interacts with vaults, APIs, or generated secrets during live operation rather than during static review.
- Escalation appears when the agent creates or uses non-human identities with access that the pre-deployment control never observed.
- Impact is a blind spot in runtime governance, where unauthorized or unexplained agent behaviour can proceed without being visible to security teams.
Breaches seen in the wild
- Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime identity is the real control plane: The article is not really about code scanning, it is about the point at which AI tools stop being development helpers and start behaving like live identities. Once an agent can create processes, touch systems, and access vaults, the decisive governance question becomes what it did at runtime, not what it looked like in a scan. Practitioners should treat runtime observation as the primary control boundary for AI coding adoption.
Shift-left security has a visibility ceiling: Pre-deployment analysis can improve code quality, but it cannot govern actions that happen after execution begins. That ceiling matters because agentic tooling changes the identity problem from human-authored code to machine-executed behaviour. The implication is that teams must stop assuming a scan result tells them anything about live access, because it does not.
NHI detection is the prerequisite, not the follow-on: You cannot secure agentic workflows if you cannot inventory the non-human identities they create and use. This is a governance sequencing issue, not a tooling preference. Entro Security’s article makes the case that visibility into service accounts, API keys, tokens, and bot activity is the foundation on which any meaningful shift-left programme has to sit.
Access review assumptions break when the actor is an agent: Access review was designed for identities whose permissions persist long enough to be observed, certified, and recertified. That assumption fails when AI agents can obtain, use, and discard access inside the same operational window. The implication is that review cadences alone cannot prove control over autonomous runtime behaviour.
Runtime blind spot is now the category risk: The market may frame this as a feature release, but the deeper issue is that AI adoption is outpacing the identity controls needed to observe it. The security stack now has a gap between code intelligence and live identity governance, and practitioners should read that as a structural programme issue, not a product limitation.
From our research library:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: Ultimate Guide to NHIs
What this signals
Runtime blind spots will matter more than code quality debates: Organisations that adopt AI coding tools without agent telemetry will keep improving static detection while missing the identities that actually execute work. The programme risk is not a weaker scanner, it is an incomplete control plane around live machine behaviour.
Agentic adoption turns NHI visibility into a prerequisite: Teams should expect AI coding tools to surface the same governance pressure points seen in broader machine identity programmes. If service accounts, tokens, and secret use are not visible, shift-left gains will not translate into runtime assurance.
Identity review cycles no longer match execution speed: When agent activity can happen at machine speed, controls built around periodic review become too slow to prove anything meaningful. That is why runtime identity telemetry belongs beside code scanning, not after it.
For practitioners
- Inventory non-human identities created by AI coding tools Track every service account, token, API key, and bot identity that an agentic workflow can create or use, then map ownership and intended scope.
- Separate pre-deployment scanning from runtime governance Use code scanning to reduce vulnerable code paths, but pair it with runtime telemetry for agent behaviour, credential use, and vault access.
- Tie agent workflows to access boundaries Define which vaults, systems, and production-like environments an AI coding tool may touch, and record those limits as enforceable access policy.
- Review runtime alerts for unexplained identity creation Flag any new non-human identity, secret issuance, or privilege change that appears during agent execution and verify it against approved workflows.
Key takeaways
- AI coding tools can improve vulnerability detection before deployment, but they do not close the runtime identity gap created by agentic execution.
- The article’s central warning is that non-human identities, credentials, and vault interactions become invisible once the code ships.
- Security teams need runtime telemetry and NHI governance to complement shift-left analysis, or they will mistake earlier detection for actual control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on runtime exposure of secrets and credentials in agentic workflows. |
| NHI-05 — Overprivileged NHI | AI coding tools can create or use identities whose access exceeds what static review can see. | |
| NHI-04 — Insecure Authentication | The post highlights authentication and access visibility gaps once agents move beyond pre-deployment review. | |
| Recommendation — Scan agent workflows for exposed secrets and revoke any credential that appears outside approved runtime scope. Map agent-created identities to least-privilege access and remove excess permissions from machine accounts. Verify how agent identities authenticate at runtime and block unauthorised credential reuse. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article focuses on agents acting through identities and privileges that scanners cannot observe. |
| Recommendation — Harden agent privilege boundaries so runtime access cannot drift beyond approved identity scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core gap is unsighted permissions and entitlements for non-human identities at runtime. |
| Recommendation — Continuously validate access permissions and entitlements for agent identities during execution. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article’s runtime blind spot maps to credential use and movement once agents are live. |
| Recommendation — Track agent credential access and pivot paths to detect machine-speed misuse before it spreads. | ||
Key terms
- Shift Left: A security approach that moves testing and analysis earlier in the software lifecycle, usually before code is deployed. It reduces obvious defects sooner, but it does not by itself govern what runtime identities, secrets, or agent actions do after execution begins.
- Shift Left: Shift left is the practice of moving security checks earlier in the software development lifecycle, usually into planning, code review, or build steps. It reduces some defects before deployment, but by itself it does not control runtime behaviour, identity sprawl, or secrets misuse after release.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Runtime telemetry: Observation of what a system actually does while it is executing. In agentic CI/CD, this means seeing which commands, files, tools, and credentials an agent touched so security teams can detect misuse that static workflow review will miss.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 10, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org