Agentic development forces a shift from human-led to machine-governed security

The death of human-centric security

Traditional application security, or AppSec, was built on the assumption that human labor was the primary bottleneck. For decades, the goal was to manage a backlog of security issues by rationing the limited attention of human developers. This model worked because humans wrote code at linear rates and attackers were often resource-constrained.

Agentic development has broken those conditions by removing the scarcity of labor. Software factories now allow specifications to be fed into agents that write, revise, and ship code autonomously. Because the volume of new code is increasing by an order of magnitude, humans can no longer act as the primary gatekeepers or auditors for every change.

As TechCrunch reported, this shift means that a backlog of security issues is no longer just a list of tasks; it is now an active liability. When software is produced at machine speed, the old method of fixing defects after they are created becomes impossible to sustain. The industry must move from a model of manual auditing to one of automated governance.

From shifting left to shifting in

For the last decade, the industry adopted a 'shift left' strategy, which aimed to find and fix defects earlier in the development process. While this helped human developers produce safer code, it is no longer sufficient for autonomous agents. If an agent is the primary author of the code, security context must be embedded inside the agentic loop itself before the code is ever emitted.

This 'shift in' approach requires three specific technical changes during the moment of code generation. First, agents must have full access to vulnerability data and fix histories without being limited by human attention. Second, guardrails must be placed directly on the agents to prevent them from taking destructive actions. Third, the system must be able to autonomously remediate old software, as no human team can clear twenty years of legacy attack surfaces.

The goal is to remove humans from the friction of minor fixes while maintaining their oversight of the final output. An agent should not need to ask permission to fix a missing semicolon or a basic vulnerability it just introduced. By automating the remediation of these issues, the system can maintain a high merge rate while ensuring the code remains functional and secure.

New risks in the agentic supply chain

Agentic development introduces unique vulnerabilities that traditional scanners might miss. One significant risk is 'slopsquatting,' where an agent hallucinates a package name that does not exist. Attackers can then register that name first, ensuring the next agent that requests the package installs a malicious payload.

The supply chain for agents is also becoming a primary target for exploitation. Agents often use skills and MCP servers to perform tasks, but these tools can be compromised before a single line of code is written. Recent research found that roughly one-third of skills in the ecosystem carry security issues, including credential theft and confirmed malicious payloads.

Because agents can pull in packages of poor quality that would never survive a human review, the surface area for attacks is expanding. These are not problems that can be solved by simply adding better tools to a human's workflow. Instead, the security fabric must be woven into the very environment where agents gather their instructions and dependencies.

The rise of the AI Security Engineer

The role of the security professional is undergoing a fundamental redefinition. Instead of chasing individual tickets, the new AI Security Engineer will design the loops that govern agent behavior. This person will set the policies that agents enforce, review the high-level decisions the system makes, and audit the final outcomes to ensure they meet the desired bar.

This transition moves the human from 'in the loop' to 'on the loop.' In the old model, humans made individual calls on every piece of code, which fails at machine speed. In the new model, humans govern the system from the outside, deciding what 'good' looks like and holding the automated factory to those standards. This allows for security that operates at the speed of the factory while retaining human accountability.

To succeed, detection must combine deterministic analysis with frontier intelligence to understand new vulnerability classes. Remediation must be intelligent enough to understand the context of the code to avoid breaking the build. Finally, a completely independent judge must attack the running software to prove the results hold, as the generator cannot be allowed to validate its own work.