How do you protect against vulnerabilities from AI coding agents?

The answers all focus on adding layers of oversight—whether automated, human, or environmental—to catch vulnerabilities AI agents might introduce, but differ in whether control is technical, procedural, or human-driven.

6 answers

Answers

  • Ric Smith

    President of Products and Technology · Okta

    Intent-based authorization

    Ric Smith says his team is building intent-based authorization, starting with deterministic fine-grained access and narrowing by intent, using a runtime detection engine rather than human judgment to decide access to toolkits, actions and data.

    TechCrunch · Watch on YouTube

  • Michael Jenkins

    C.T.O. · Threatlocker

    Allowlisting and vetting

    Michael Jenkins says software still has to be vetted and that allowlisting is where it comes in, because everyone is now a developer and AI-written executables are being run.

    Security Weekly - A CRA Resource · Watch on YouTube

  • Thariq Shihipar

    Member of Technical Staff · Anthropic

    Secure sandboxes

    Thariq Shihipar says preventing unpredictable incidents from AI agents requires operational excellence, including secure sandboxes and well-designed RL environments, since you can't predict the next incident.

    Latent Space · Watch on YouTube

  • Idan Plotnik

    Co-Founder & CEO · Apiiro

    Guardian agent

    Idan Plotnik says his company's answer is a guardian agent that guards all coding agents, providing one control plane for context, governance, security and protection so customers can adopt coding agents safely.

    Application Security Weekly (Video) · Application Security Weekly (Video) · Listen at 36:27

  • Angie Jones

    VP Engineering, AI Tools & Enablement · Block

    Recursive adversarial review

    Angie Jones says she runs a recursive adversarial review: a fresh sub-agent reviews the diff without knowing why it was built, fixes and repeats until nothing is left, because agents are biased and think their own work is superb.

    Quality Remarks - The Podcast · Quality Remarks - The Podcast · Listen at 27:10

  • Daniel Herrington

    Chief AI Officer · The Zebra

    Human review

    Daniel Herrington says his team still has a human reviewer take a second look at any code using customer data, even with an automated reviewer, to make sure it’s on track.

    The Software Leaders Uncensored Podcast · The Software Leaders Uncensored Podcast · Listen at 14:44

More Software Engineering questions

View all →