Topic starter
06/09/2026 6:20 pm
TL;DR: AI coding agents are widening an existing secure SDLC gap by producing vulnerable code, obscuring agent identity, and shifting controls earlier in the lifecycle, according to Arnica’s checklist for AppSec teams. The practical implication is that design-time rules, generation-layer governance, and code-owner routing now matter as much as scans at merge time.
Editorial analysis by NHI Mgmt Group, based on content published by Arnica: “SSDLC Checklist for AppSec Teams (September 2026)”.
By the numbers:
- Fixing a bug in production can cost up to 100x more than catching it at design, according to Arnica.
- Arnica says 82% of findings point to developers who have already left, which complicates routing remediation to the right owner.
Key questions
Q: What breaks when AI agents are not governed at runtime?
A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context.
Q: Why do AI-generated pull requests need different security handling than human-written code?
A: AI-generated changes are often broader, faster and less obviously traceable than human-written edits, so the security model has to account for agent identity, generation rules and automatic reproduction of insecure patterns.
Q: How do teams know if SDLC security tooling is actually working?
A: It is working when findings are reduced to the issues that matter most, remediation happens without breaking releases, and secrets are blocked before they land in shared history.
Practitioner guidance
- Define security controls by SDLC phase Map requirements, design, coding, testing, deployment and maintenance to explicit security gates so each phase has a named control owner and acceptance criterion.
- Enforce rules inside agent configuration files Write security policy into the agent settings or instruction files that AI coding tools read before generating code, and review those files as governed artefacts.
- Track agent identity separately from developer identity Record which AI agent or bot identity produced a change, then route findings against the active owner rather than the original committer when remediation is required.
Bottom line: AI-generated code widens secure SDLC gaps because late-stage scanning cannot compensate for insecure output produced earlier in the pipeline.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:21 pm
Agentic SDLC governance is now a core application security problem, not an AI novelty. The article shows that code generation, review routing and security ownership are now interdependent control points. Once an agent can draft most of the change, the old assumption that security can wait for PR review no longer holds. Practitioners should treat the agent as part of the delivery pipeline and govern it accordingly.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between AI-powered secure SDLC and traditional secure SDLC?
A: AI-powered secure SDLC adds automation and contextual analysis to standard secure development practices. Traditional secure SDLC relies more on manual review, fixed rules, and periodic checks. AI can scan code continuously, prioritise findings by context, and provide remediation guidance earlier in the workflow, which helps teams keep pace with modern release velocity and larger codebases.
👉 Read our full editorial: AI-generated code is widening secure SDLC gaps across every phase