AI Coding Agent Security: What Enterprises Need Before Deploying

The enterprise adoption problem

AI coding agents have moved from experiment to infrastructure. Engineers use them to generate boilerplate, write tests, refactor legacy code, and build entire features from natural-language descriptions. The productivity gains are real. So are the risks.

The problem is not the AI models themselves. It is the way agents operate: with broad repository access, network connectivity, the ability to install packages, and credentials that persist long after a session ends. An AI coding agent on an engineer’s machine often has the same access as the engineer. When that access is compromised, the blast radius matches the engineer’s permissions.

Replit’s CEO has warned that AI coding agents on employee devices are a security risk for enterprises. The concern is not theoretical. These agents read source code, write to repositories, execute shell commands, and interact with external services. Every one of those capabilities is an attack surface.

The vulnerability landscape

The data on AI-generated code quality is sobering. Veracode research found that 45% of AI-generated code samples introduce vulnerabilities from the OWASP Top 10 list. That includes injection flaws, broken access control, security misconfiguration, and insecure deserialization. These are not edge cases; they are the most common and well-documented vulnerability classes in web application security.

Georgia Tech’s Vibe Security Radar tracked 35 CVEs in March 2026 alone attributed to AI coding tools. That is 35 publicly disclosed vulnerabilities in a single month, each with a unique identifier, each representing a real security flaw that made it into codebases.

One of the most severe was CVE-2025-53773: a hidden prompt injection embedded in a pull request description that enabled remote code execution through GitHub Copilot. It carried a CVSS score of 9.6 out of 10. The attack worked because the AI agent processed the PR description as context, and the injected instructions told it to execute arbitrary code. The engineer reviewing the PR saw normal text; the agent saw executable instructions.

Then there is agentjacking. Research found that 85% of AI coding agents tested were vulnerable to this class of attack, where a malicious actor manipulates or takes over an AI agent while its authorization credentials remain intact. The agent keeps working, keeps pushing code, keeps accessing systems, but it is now acting on behalf of an attacker. Because the credentials are valid, standard monitoring sees nothing unusual.

Supply chain risks: MCP servers, tools, and credential scope

AI agent security is a supply chain problem first, prompt injection problem second. The security community has focused heavily on prompt injection, and that focus is warranted. But the larger risk surface is the tool chain.

Modern AI coding agents connect to MCP servers, package registries, APIs, CI/CD pipelines, and cloud services. Each connection is a dependency. Each dependency is a potential entry point. A compromised MCP server can feed malicious tool descriptions to the agent. A poisoned package in a registry can be suggested and installed by the agent as a legitimate dependency. A leaked API key in a .env file gives the agent (and any attacker who compromises the agent) access to whatever that key unlocks.

The MCP specification addresses some of this by requiring that tool descriptions be treated as untrusted input and that users explicitly consent to tool execution. But the specification is only as strong as its implementation. Many MCP server deployments do not enforce these requirements. Our guide to building MCP servers covers the security requirements the spec mandates, and they are substantial.

Credential scope is the other half of the supply chain problem. A compromised agent credential gives attackers access equivalent to that agent’s permissions for weeks or months. If the agent has write access to production repositories, so does the attacker. If the agent has credentials for cloud infrastructure, those credentials are now compromised. The window of exposure depends entirely on how frequently credentials are rotated, and in many organizations, agent tokens are treated as set-and-forget.

The Goldman Sachs signal

Reports indicate Goldman Sachs restricted access to AI coding tools like Claude Code and GitHub coding agents to engineers only, rather than making them available across the organization. This is not a rejection of AI coding tools. It is a scoping decision, and it reveals how seriously large enterprises treat the risk.

The logic is straightforward: AI coding agents generate code that requires expert review. Giving these tools to people who cannot evaluate the security implications of the output is an unnecessary risk. An engineer can recognize an SQL injection pattern in generated code. A product manager or analyst probably cannot. Restricting access to the people who can evaluate the output is a basic access-control principle applied to a new tool category.

This pattern will spread. As more enterprises encounter the vulnerability data described above, the default will shift from open access to scoped access. The question is whether your organization gets ahead of that shift or reacts to an incident.

The enterprise security checklist for AI coding agents

These are not aspirational recommendations. They are the minimum controls that need to be in place before AI coding agents operate on enterprise codebases.

1. Permission scoping. Every AI agent should operate with the minimum permissions required for its task. If an agent generates code for a frontend repository, it should not have credentials for the database, the CI/CD pipeline, or the cloud infrastructure. Scope permissions per agent, per repository, per task.
2. Mandatory code review gates. No AI-generated code should merge without human review. This is not a suggestion; it is the single most effective control against the 45% vulnerability rate. Static analysis tools should run automatically on every AI-generated change, and the results should be visible to the reviewer.
3. Sandboxed execution. AI agents that execute code should run in isolated environments with no access to production systems, sensitive data, or network resources beyond what the task requires. Container-based sandboxes with strict network policies are the baseline.
4. Credential rotation. Agent tokens and API keys should rotate on a short schedule: days, not months. Automated rotation removes the human forgetting factor and limits the window of exposure if a credential is compromised. Treat agent credentials with the same rigor as service account credentials in production infrastructure.
5. Audit logging. Every action an AI agent takes should be logged: files read, files written, commands executed, APIs called, packages installed. These logs should be immutable, retained, and monitored. When something goes wrong, the audit trail is what tells you what happened and how far the compromise reached.
6. MCP server vetting. Every MCP server and third-party tool connected to an AI agent is a supply chain dependency. Vet each one before connecting it. Review the source code if available. Verify that it enforces the security requirements the MCP specification mandates: user consent for tool execution, untrusted tool descriptions, and data privacy controls.
7. Access restriction by role. Follow the Goldman Sachs pattern: restrict AI coding agent access to engineers who can evaluate the security implications of the output. This is not about gatekeeping; it is about matching tool capabilities to the expertise needed to use them safely.

How Webvello approaches AI agent security

Webvello builds AI agent systems and Claude Code workflows for businesses. Security is not an afterthought in that work; it is the starting constraint. Every AI agent deployment we build starts with permission scoping, credential management, and audit logging before any business logic.

Our Claude Code consulting practice includes security reviews of existing AI agent deployments. We audit credential scope, review MCP server configurations, verify that code review gates are enforced, and test for the vulnerability classes described in this article. The goal is a clear picture of exposure and a concrete plan to close gaps.

For enterprises evaluating AI coding agents, we also offer AI search optimization that accounts for how AI systems discover and reference your organization’s content. The same principles of structured data, explicit permissions, and controlled access apply whether the AI is generating code or surfacing your business in search results. You can see examples of this integrated approach in our project portfolio.

Frequently asked questions

About the work

Webvello is an AI search optimization and AI agent development company founded in 2024, based in Roseville, California. We build secure AI agent systems, MCP integrations, and Claude Code workflows for businesses that need AI tooling they can trust in production. Founder George Shvaya came to this work from cybersecurity and systems engineering, which is why this article reads vulnerability disclosures and CVE reports rather than paraphrasing marketing copy. When the topic is security, the primary sources matter.

Sources: Veracode research on AI-generated code vulnerabilities, Georgia Tech’s Vibe Security Radar (March 2026 CVE tracking), CVE-2025-53773 (CVSS 9.6, prompt injection via PR descriptions), agentjacking research (85% vulnerability rate), reports on Goldman Sachs AI tool restrictions, the OWASP Top 10, the MCP specification, and Anthropic developer documentation. All links verified November 3, 2026. Security research evolves quickly; check the linked sources before relying on a specific figure.