A Security Program for Agent-Assisted Coding

Security debt in agent-assisted coding accumulates not at one uniquely “bad” line, but at a chain of boundary crossings: content becomes direction, a declaration becomes executable input, a value becomes identity, a pull request becomes accepted state, and a model recommendation becomes an action with real authority. This final synthesis asks how a team can audit that chain, decide what deserves priority, and assign controls without confusing a measured smell with a confirmed incident. The result is a security program grounded in the evidence while remaining honest about what the supplied studies did not test.

The central judgment is now clear. Autonomous coding changes the speed and shape of software work, but it does not remove the older security questions about identity, privilege, integrity, confidentiality, availability, or review. It makes their boundaries more dynamic. An agent can choose intermediate steps, consume untrusted content, call tools, share state, and prepare a large change before a human sees the final diff. The security property therefore belongs to the whole action chain—from task and context to code, review, integration, build, deployment, and recovery.

One debt path runs from a small change to a system consequence

The empirical evidence identifies where to look first. In the selected high-risk, added-line surface, 38.9% of valid pull requests contained at least one security smell, and supply-chain-integrity patterns made up 82.3% of the detected smell volume. The critical tail was different: 99.6% of critical findings were in the secrets-identity category. Human committers were associated with 67.6% of the 74 manually confirmed genuine credentials, while the paper reports that 81.1% of those cases reached integration without a review comment from a bot or human. These figures do not tell one simple story about “AI-generated insecurity.” They show several boundaries failing in different ways.

A supply-chain smell is primarily a trust-and-reproducibility problem. A mutable action or image reference, or an unpinned global install, can leave the artifact selected by a future build less determined by the text a maintainer reviewed. The risk becomes consequential when the build runner retrieves and executes that artifact. The changed line is the entry point, but the effective boundary includes the external source, resolution time, runner, permissions, and downstream deployment.

A credential finding is an identity problem. A secret-shaped value must first be distinguished from a placeholder or example, then connected to a commit and a review record. If it is genuine, the next question is what can accept it and whether the value can reach an integration or execution boundary. The study’s human attribution result matters because the relevant control cannot inspect only model output. The artifact may be shaped by a person, an agent, or both, and the workflow must protect the boundary regardless of the presumed author.

An over-privilege, network, transport, or hardening smell changes a different part of the path. It may expand what a process can modify, who can reach a service, what an observer can see, or what sensitive state the system records. A short permission change in a CI workflow can matter more than a long application edit if it changes the authority of the runner. A small network exposure can matter more than a large refactor if it changes who can send requests. Frequency tells a team how often a pattern appeared in the measured surface; authority tells the team how far the consequence could travel.

The broader agent-security analysis adds the architecture around that code-level evidence. Repository content, documentation, dependency metadata, and tool results may influence an agent’s next action even when they were not direct user commands. Tools can expose files, execute code, install software, call external services, or modify a workspace. Shared state can preserve an erroneous or hostile instruction beyond the step that created it. Delegation can let a less privileged component induce a more privileged one to act. Hosting can shift exposure to networks, devices, tunnels, pairing, providers, or configuration. These are supported threat mechanisms, not incidents measured in the pull-request dataset, but they explain why a secure-looking diff is not the whole system.

A useful way to combine the two sources is to ask five questions about every consequential change. What information or instruction entered the agent’s context? What authority did the resulting action receive? Which state or resource did the action change? Who or what reviewed the transition? What could happen if the action were repeated, redirected, or executed under a different external state?