Agentic development increases risk because the volume and pace of generated code can exceed what humans can review effectively. When agents produce most of the application, infrastructure, and integration logic, security findings arrive too late if they are only checked in pull requests. Continuous analysis in the development loop is needed to keep control coverage aligned with production impact.
Why manual review breaks down in agentic development pipelines
Agentic development environments change the review problem from “Can a human approve this change?” to “Can a human still see enough of the change to judge it safely?” When agents generate code, infrastructure, tests, and integrations at machine speed, the security burden shifts toward continuous validation rather than end-of-pipeline inspection. For readers exploring the governance side of this problem, the OWASP OWASP Top 10 for Agentic Applications 2026 is a useful reference point because it frames the risks introduced by autonomous tool use, delegated actions, and control loss.
Manual review fails here for a simple reason: reviewers tend to focus on the visible diff, while the real risk often sits in the generated dependency chain, hidden permissions, build steps, or insecure defaults introduced across many small changes. That means insecure patterns can be repeated, normalised, and merged before anyone sees the full effect. In practice, many security teams encounter the control gap only after agent-generated changes have already accumulated into a release candidate that looks routine on paper.
How the risk accumulates across generated code, integrations, and trust boundaries
Agentic systems increase risk when they can repeatedly create small, plausible changes that individually look low impact but collectively reshape the application’s security posture. A human reviewer may spot an obvious flaw in a single pull request, yet miss that the agent also added a library, altered a pipeline, exposed a secret path, and widened an integration scope elsewhere. That is why the security question is not just code quality; it is whether the environment preserves enough oversight across the whole development loop to detect compounded change.
In an agentic workflow, review often happens too late in the chain. By the time a pull request is opened, the agent may already have made several design choices that are expensive to unwind. If the environment uses generated tests as evidence of safety, that evidence can be misleading when the tests only confirm the agent’s own assumptions. This is where continuous analysis inside the development loop matters more than a final manual gate: it can catch risky dependency changes, unsafe prompt-driven code generation, and unexpected expansions in privileges or data access before they become embedded.
- Review fatigue grows when output volume rises faster than reviewer capacity.
- Security regressions are easier to miss when each change is locally reasonable but globally unsafe.
- Control drift appears when agents reuse patterns that were acceptable once but become harmful at scale.
- Trust boundaries blur when the same agent can propose code, change infrastructure, and call tools.
The practical issue is not that human review has no value. It is that manual review is a sampling mechanism, and agentic development can generate far more change than sampling can safely cover. Where the environment lacks continuous checks, this guidance breaks down as soon as agent output becomes faster than the team’s ability to understand the cumulative security impact.
Where agentic teams overestimate review, and where exceptions matter
Tighter review often increases delivery overhead, requiring organisations to balance speed against assurance. That tradeoff becomes sharper when teams assume that “more reviewers” solves the problem, because the bottleneck is often not headcount but context. A human can approve a change only if the reviewer can understand the dependencies, runtime effect, and privilege implications in time.
There is also a genuine consensus gap in the industry: teams agree that manual review is necessary, but not on how much it can reasonably be trusted once agents are producing most of the artefacts. For low-risk experiments, manual approval may still be acceptable. For environments where agents can alter build pipelines, deployment logic, or access-related code, the review process needs stronger machine checks and clearer separation of duties.
Practitioners should treat any workflow that depends on reviewers reading every meaningful security consequence as fragile by design. The better question is whether the environment can make unsafe output fail earlier, before it reaches a human approver. When that cannot be guaranteed, manual review becomes a final reassurance rather than a real control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 — Oversight and Human Control | Directly addresses delegated agent actions that outpace human review. |
| Recommendation — Add pre-merge guardrails that force risky agent output through automated checks. | ||
| NIST AI RMF | GV-2 — Map Context and Relevant Risks | Applies to governing AI-assisted development and its security risk context. |
| Recommendation — Define where agentic development needs continuous assurance, not just manual approval. | ||
| MITRE ATLAS | AML.TA0004 — Information Gathering | Relevant where agentic systems create hidden exposure through generated artefacts and access paths. |
| Recommendation — Trace how agent-generated changes expand attack surface and validate each new trust path. | ||
| CIS Controls v8 | 4.1 — Establish and Maintain Secure Configuration Process | Fits when agents alter build, deployment, or configuration state at speed. |
| Recommendation — Use secure configuration controls to detect and block unsafe agent-driven changes. | ||
| NIST CSF 2.0 | PR.IP-1 — Baseline Configuration | Supports maintaining a trusted baseline when agent output changes system state rapidly. |
| Recommendation — Maintain a known-good baseline and flag agent changes that drift from approved state. | ||
Practitioner Guidance
What to prioritise: Prioritise controls that surface security-relevant change during generation, not only at merge time. If the agent can influence code, build logic, or deployment configuration, the team should assume pull request review will miss some compounded effects.
What to verify: Verify that reviewers can see the full blast radius of a change, including dependencies, permission shifts, and infrastructure side effects. If they cannot explain how a generated change affects runtime trust or access, the review is too shallow to rely on.
Decision rule: If an agent can create repeated changes across application, CI/CD, and infrastructure layers, treat manual review as a backstop and require continuous validation in the workflow. If the agent’s output is narrow and low consequence, lighter review may still be defensible.
Practitioner takeaway: The security failure is usually not one bad diff but many small ones that reviewers cannot mentally compose fast enough, so the control must move closer to generation before scale turns judgment into guesswork.
Related resources from NHI Mgmt Group
- How should security teams govern machine identity credentials in agentic AI environments?
- What breaks when application security teams rely on manual review instead of automated risk signals?
- How should security teams limit the risk from AI agents that have access to production systems?
- Why do ERP environments increase identity risk for security teams?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
