It passed review. It shipped. It skipped the check.

Assistants now write a large share of production code, and agents act with the permissions they were given plus whatever a prompt can talk them into. We test what actually shipped, not who wrote it, across 280+ patterns specific to generated and agentic code.

Who it is for

  • Engineering teams using Copilot, Cursor, Claude Code or similar
  • Products with agents, tools or MCP servers in production
  • Security leads asked to sign off on AI-generated pull requests
  • Companies adopting agents faster than they can govern them

How it runs

  1. Map

    Generated surface

    We identify handlers, jobs and integrations written or heavily modified by assistants, and every agent, tool and connected service with standing access.

  2. Test

    Behaviour, not authorship

    Ownership, validation, rate limits and secrets handling are tested on the live product. Agents are probed with content an outsider controls: issues, documents, web pages, emails.

  3. Constrain

    Least privilege for agents

    Each agent holds only the permissions its current task needs. Injection paths are closed or sandboxed with your team.

  4. Lock

    Rules on every release

    Rules such as "content an outsider controls must never become an instruction" run on every deploy, so the next generated change is tested the same way.

What you get

From the record · Black Hat 2026 · August 2026Coding agents from three major labs hijacked through a single crafted GitHub issue.The agent did what it was told. The problem was who got to tell it.Read the record →
01
Generated-code findingsWhere assumed checks were never written, with the fix merged.
02
Agent permission mapWhat each agent and tool can reach, and what it needs.
03
Injection test resultsWhich inputs an agent will act on, and the guardrails that stop it.
04
Rules for AI-written codeRe-tested on every release regardless of author.

Questions

Is AI-written code less secure than human-written code?

Not inherently, but it fails differently. Generated code tends to be syntactically clean and pass review while omitting checks the author assumed existed: ownership, rate limits, input bounds. Testing behaviour catches these regardless of authorship.

What is prompt injection in an agent?

Prompt injection is when content an agent reads, such as an issue, document or web page, contains instructions the agent follows as if they came from its operator. In agents with tool access this becomes a way to run commands or exfiltrate data.

How do you secure AI agents in production?

Give each agent its own identity and the minimum permissions for its task, treat all outside content as untrusted data, log and gate high-impact actions, and test the agent against injection on every release.

Can you review our AI-generated pull requests?

We test the deployed behaviour, which covers each PR. Rules run on every release, so a generated change that weakens a check fails before it ships.

Know where you stand.

Book the hour