Notifications
Clear all
Topic starter
18/08/2026 2:35 pm
TL;DR: Security leaders at RSAC 2026 argued that AI is collapsing the old developer-centric AppSec model, because employees can now create production-like software and disposable agents at speed, according to LEGIT Security. The practical shift is from training and gates to structural control of agent identity, permissions, telemetry, and policy enforcement inside the workflow.
NHIMG editorial — based on content published by LEGIT Security: RSAC 2026 panel analysis on AI-generated code and AppSec governance
Questions worth separating out
Q: What breaks when AI-generated code is reviewed without security gates?
A: What breaks is the assumption that a clean-looking diff is a safe diff.
Q: Why do local AI agents complicate identity and access management?
A: They can retain legitimate permissions while changing timing, prioritisation, and action sequence outside human presence.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Define agent identity at creation time Assign every AI agent a unique identity, explicit owner, and scoped permission set before it can access tools or data.
- Replace manual gates with policy embedded in workflows Move approval logic, data access boundaries, and tool restrictions into the development and runtime workflow so they execute automatically at the point of action.
- Instrument agent telemetry for incident reconstruction Capture identity-linked logs, traces, and policy decisions for every agent action, including tool calls and data access.
What's in the full article
LEGIT Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Panel context from RSAC 2026, including how the speakers framed agentic AppSec and organisational readiness
- Specific examples of teams shipping agents in days and the governance lessons those leaders drew from that experience
- The incident response questions raised by rogue-agent investigations, including telemetry and traceability concerns
- The panel's closing disagreements on workforce impact and which skills will matter most as execution becomes cheaper
👉 Read LEGIT Security's RSAC 2026 panel analysis on AI-generated code and AppSec governance →
AI-generated code and agents: what AppSec teams need to change now?
Explore further
18/08/2026 3:21 pm
AI-generated software is turning AppSec into a runtime identity problem: once code and agents can be created in minutes, the old assumption that security can review work before it matters stops being reliable. That means the real control point shifts to identity, permission scope, and policy enforcement at creation time. In practical terms, this is where NHI governance becomes part of AppSec rather than a separate discipline.
A question worth separating out:
Q: Who is accountable when an AI agent causes a security incident?
A: Accountability should sit with the business owner, the system owner, and the security function together, because agent behaviour crosses operational boundaries. Organisations need a defined owner for approval, monitoring, and retirement, plus audit evidence that shows what the agent accessed and why.
👉 Read our full editorial: AI-generated code is forcing AppSec to become runtime governance
