Topic starter
18/08/2026 2:35 pm
TL;DR: Security leaders at RSAC 2026 argued that AI is collapsing the old developer-centric AppSec model, because employees can now create production-like software and disposable agents at speed, according to LEGIT Security. The practical shift is from training and gates to structural control of agent identity, permissions, telemetry, and policy enforcement inside the workflow.
Editorial analysis by NHI Mgmt Group, based on content published by LEGIT Security: “When AI Writes the Code, What Changes for Security?”.
Key questions
Q: What breaks when AI-generated code is treated like normal developer output?
A: Teams can miss insecure patterns, risky dependencies, and hidden assumptions because the review process assumes human authorship.
Q: Why do disposable agents increase risk in AppSec programmes?
A: They compress the time available to detect misuse, so a permissioning mistake can be exercised and forgotten before a review cycle catches it.
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Practitioner guidance
- Define agent identity at creation Assign each AI agent a unique, scoped identity and ownership record before it can execute work.
- Move policy enforcement into the workflow Embed policy checks into the same systems that generate, approve, and run AI-created code.
- Build telemetry for agent traceability Log which agent acted, which tools it used, what resources it accessed, and which policy decision applied.
Bottom line: AI-generated code and disposable agents undermine AppSec models that depend on durable code and delayed review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:21 pm
Runtime governance is becoming the new AppSec boundary: when code is generated and executed faster than review cycles can keep up, the security model has to move from pre-deployment approval to in-workflow control. The old assumption was that developers were the primary control point. That assumption no longer holds in environments where any employee can create software or an agent quickly. Practitioners should treat the workflow itself as the control surface.
A question worth separating out:
Q: What should incident response teams do when an AI agent may have acted outside policy?
A: They should prioritise reconstruction over assumptions. If the agent may already be gone, responders need logs that identify the agent instance, its permissions, the tools it used, and the resources it touched. That evidence determines whether the event can be contained, explained, and audited with confidence.
👉 Read our full editorial: AI-generated code is forcing AppSec to become runtime governance