Notifications
Clear all
Topic starter
02/08/2026 12:18 pm
TL;DR: Google DeepMind’s CodeMender and OpenAI’s Aardvark show how agentic AI is moving into AppSec automation, with repository-wide scanning, exploitability validation, and patch proposal workflows, according to Checkmarx. The real governance question is whether these tools reduce remediation friction without creating new trust, validation, and runtime risk gaps in developer pipelines.
NHIMG editorial — based on content published by Checkmarx: AI AppSec agents are shifting security left, but gaps remain
Questions worth separating out
Q: What breaks when AI AppSec agents are allowed to approve their own fixes?
A: Control quality breaks first, then code integrity.
Q: Why do AI monitoring programmes need identity and access controls?
A: AI monitoring programmes need identity and access controls because the telemetry often includes sensitive prompts, outputs, training data, and configuration details.
Q: How do teams know whether AI-assisted AppSec is actually helping?
A: Look for findings that can be traced back to named components, repeated across assessments, and mapped to concrete remediation actions.
Practitioner guidance
- Classify AppSec agents as non-human identities Assign each code-security agent a named owner, scoped permissions, and a documented lifecycle for onboarding, rotation, review, and offboarding across repositories and build systems.
- Separate suggestion from acceptance Require human approval for all agent-generated patches, and block any direct merge path where the same system both identifies and approves the fix.
- Constrain validation to isolated sandboxes Run exploitability checks and test-case generation in controlled environments that cannot reach production secrets, live credentials, or privileged deployment paths.
What's in the full article
Checkmarx's full post covers the operational detail this analysis intentionally leaves for the source:
- How the Developer Assist workflow is positioned inside the IDE and how it handles inline remediation.
- The specific Safe Refactor behaviour described for preserving build integrity and updating repository dependencies.
- The vendor's examples of IDE integrations and workflow touchpoints across developer tools.
- The implementation framing around pre-commit prevention versus post-commit review.
👉 Read Checkmarx's analysis of agentic AI AppSec and developer workflow security →
AI AppSec agents and shift-left security: are controls keeping up?
Explore further
02/08/2026 1:19 pm
AI AppSec is now a governance problem, not just a tooling problem. Once an agent can read code, validate findings, and propose fixes, it becomes part of the control plane for software delivery. That makes its identity, permissions, and output constraints relevant to IAM, PAM, and NHI governance. The practical conclusion is that security teams must classify these agents as production actors with accountable access, not as passive add-ons.
A question worth separating out:
Q: Should organisations use agentic AppSec tools before they have full secrets governance?
A: Only with caution. Agentic AppSec tools can help reduce code risk, but they do not replace secrets discovery, rotation, and revocation. If secrets are already leaking into repos or pipelines, an AI reviewer becomes another privileged system operating in a weak environment. Governance should cover code, identities, and secrets together.
👉 Read our full editorial: AI AppSec agents are shifting security left, but gaps remain
