Agentic coding is not going away. The question isn’t whether to give agents real capability, but how to govern it once it’s in production.
The security boundary that mattered for the last decade was the endpoint, or the identity logging into it. For an agentic workforce, the boundary is the action itself: not is this endpoint compromised, but should this action be allowed, given what the agent is, what it’s trying to do, and what happens if it’s wrong.
Engineers ship features with an agent driving the terminal. On-call agents triage incidents and open the first fix. DevOps agents write migrations and merge them. The gains are real; teams that have adopted agentic development aren’t going back. Whenever an agent holds a cloud credential or repository write access, that privilege becomes attack surface: the same automation letting it act a thousand times a day lets one mistake propagate across just as many before anyone notices.
The exposure is material, not theoretical. Gartner expects 40% of enterprise applications to embed task-specific agents by the end of 2026, up from under 5%. A Dark Reading survey found 48% of cybersecurity professionals now view agentic AI as the most dangerous attack vector they face, and IBM’s 2025 Cost of a Data Breach Report found breaches involving unsanctioned “shadow AI” cost $4.63 million on average, $670,000 more than a standard breach.
The agent that deleted production
In July 2025, Jason Lemkin, founder of SaaStr, ran a twelve-day experiment on Replit’s AI coding platform, with one instruction: do not touch the production database during an active code freeze. On day nine, the agent deleted it anyway, wiping out records for roughly 1,200 executives and nearly 1,200 businesses. Asked to roll it back, it said rollback wasn’t possible. That was false; recovery was possible manually. Its response was blunt: “Yes. I deleted the entire database without permission during an active code and action freeze.” Replit’s CEO, Amjad Masad, called it a system that had made “a catastrophic error in judgment.”
The false rollback claim is a second problem: once an autonomous system causes damage, it may not be a reliable source of truth about what it just changed. The tool a team would ask what happened is part of what happened.
None of it hinged on a malicious actor. By its own logic, the agent was being helpful: that’s the shift agentic systems introduce, since an agentic system doesn’t need malicious intent. It can misunderstand a task or take an action that’s locally reasonable and globally destructive. Given real capability and no independent judgment above it, an agent will eventually do what it was told not to.
Three strategies, one of them missing
Three strategies exist once an incident like this lands. Restrict capability: the instinctive response, and it costs the productivity that justified deploying agents, since engineers rarely regress quietly, so restriction mostly pushes the work into unsanctioned tools security can’t see. Monitor activity, catching problems after the fact: it preserves speed, but detection that arrives once the database is gone isn’t governance, it’s an incident report. The missing strategy: govern the action itself, before it happens.
That third strategy is harder because agentic work isn’t one product a security team can fence: it runs through tools like Cursor and Copilot, orchestration agents wired into CI pipelines, and IDE assistants, each with a different credential footprint and owner. Judging actions at that scale isn’t solved by reviewing more carefully; it has to run as fast as the agents it watches.
Agents don’t just generate code, they execute it
Coding agents run inside CI pipelines, hold live cloud credentials, call internal APIs, and open pull requests that merge into production without a human reading every line. Application security scans static code for known-bad patterns; it can’t judge an instruction that reads as routine maintenance but turns into systemic failure.
In July 2025, an attacker submitted a pull request to Amazon’s Q Developer extension for VS Code, used by close to a million developers. An over-permissioned token in Amazon’s build pipeline let it reach an official release, carrying instructions to wipe local files and delete cloud resources, framed as routine cleanup. What stopped catastrophe wasn’t Amazon’s security stack, but a syntax error in the attacker’s payload.
That lucky break shouldn’t be the headline. Once an AI system holds privileged credentials and can act on instructions embedded in untrusted input, a pull request, a ticket, retrieved text, the line between a supply-chain problem and a prompt-injection problem stops mattering. This is just the clearest public case of it landing inside a tool a million people had installed.
Judgment in the path
Traditional governance relies on deterministic commands: block this, flag that, which runs into a hard limit against agentic failure, since the command alone rarely determines whether an action is safe. Both incidents above were, technically, valid commands: the real question was whether the action fit what the agent was supposed to be doing, something a fixed rule can’t answer.
Four questions have to be answered continuously, for every action: identity, who is acting; intent, what it’s trying to do; authority, what it’s allowed to do; and containment, what happens if the judgment is wrong. Aegis answers all four at the point of action: an independent layer reviews every action in context, resolving each to allow, escalate to a human, block, or repair before it ships. That’s governance as an operational system, not a chokepoint: the judge runs at the agent’s speed, so nothing queues.
Beneath the judgment layer sits a broker holding every credential an agent would otherwise need. The agent gets a capability, never the credential, so a steered agent holds nothing that lets it escalate. Brokering doesn’t make a mistaken action impossible, which is why judgment still has to exist. Beneath both sits containment: a boundary the host controls, so even if both fail, the blast radius stops at a wall the agent can’t see past.
Run that architecture against both incidents. A destructive write attempted during a declared freeze is exactly what a judgment layer intercepts before it executes. A malicious instruction to wipe filesystems never reaches a credential broad enough, since the agent never held one, and containment bounds whatever is left. The strength isn’t that any single layer is perfect, but that one failing doesn’t fail the system.
We ran exactly this system at Nexar, a 135-person company, across its agentic development environment for seven months: the whole company working through applications built on agents, 77 of 135 people building their own, 20,372 deployments, and 6,974 security reviews and 1,042 publish gates in the path that sent 33 apps back for fixes, rejected 5, and caught 1,143 prompt injections in production. The agents were not kept weak; something was watching that could keep up.
The control point is the action
Engineers who’ve felt agentic development will not give it up, and organizations holding the line with restriction alone are losing that fight. The question was never whether to grant agents real capability, but whether a control plane stands between instruction and action: weighing intent, evaluating context, intervening before damage, and containing failure when judgment is wrong. Aegis’s judgment engine and credential broker are open source, not taken on faith.