Topic starter
20/08/2026 5:24 pm
TL;DR: Agentic Development Lifecycle assumptions break down as autonomous code generation, dependency selection and tool use move work beyond human-paced review, according to Cycode. Governance has to move into execution paths, because agent-driven changes can slip past IDE-centric controls and carry supply chain and policy drift into production.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “Securing the Agentic Development Lifecycle (ADLC)”.
By the numbers:
- Cycode reports that 100% of surveyed organisations confirmed they have AI-generated code in their codebase.
- Cycode reports that 81% have no visibility into how AI is actually being used across their development lifecycle.
Key questions
Q: Why do autonomous package installs by AI agents increase supply chain risk?
A: Autonomous installs increase risk because the approval often happens on reflex, not informed review.
Q: What are the signs that agentic development controls are failing?
A: The main signals are silent dependency choices, unexpected secret access, agent tool calls to services outside the approved workflow and code changes that appear without a clear human decision trail.
Q: What breaks when AI agents can make code changes faster than humans can review them?
A: Manual review stops being a meaningful control if it cannot keep pace with change volume.
Practitioner guidance
- Inventory agentic development surfaces Identify every place where AI agents can create, modify, test or merge code, including chat tools, CLIs, orchestration layers and MCP-connected workflows.
- Bind agent actions to explicit policy Define which repositories, dependencies, APIs and environments each agent may touch, and block any execution outside those boundaries.
- Add continuous supply chain validation Check model provenance, dependency legitimacy and tool-server trust before changes reach merge or deployment stages.
Bottom line: Agentic development exposes a security gap because code, dependencies and tool calls can now be produced by non-human actors that traditional SDLC controls were never designed to supervise.
Glossary terms: Agentic Development Lifecycle, Agentic Supply Chain, MCP Server, Hallucinated Dependencies
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
20/08/2026 6:14 pm
ADLC creates a governance gap, not just a tooling gap: once agents can write, choose and commit code, the old assumption that human review is the primary security checkpoint no longer holds. Security teams are no longer governing developer output alone, they are governing machine decisions that happen before a human sees the change. Practitioners should treat agent execution as a controlled identity and access problem, not only an application security workflow.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern AI-assisted development workflows that use coding agents?
A: Treat them as identity-governed execution paths, not just productivity tools. Define who can start the workflow, which tools and data sources it can reach, what evidence is required for review, and how access is revoked if the workflow expands beyond its intended scope. The key is to govern the chain of delegated action, not only the final code output.
👉 Read our full editorial: Agentic development lifecycle security is exposing new supply chain risk