As AI coding agents take on end-to-end software development tasks—writing authentication flows, configuring form handlers, and modifying core infrastructure—engineering teams are facing a critical security gap. According to Greg Jennings, VP of Engineering for AI Products at Anaconda, building a secure-by-default AI coding agent requires moving enforcement out of vulnerable natural-language prompts and directly into system runtimes.
Prompt Discipline Fails at Scale
Today’s AI coding agents do far more than autocomplete lines in an editor. They run shell commands, invoke external tools, open pull requests, and touch cloud architecture. Yet most engineering organizations still attempt to govern these powerful actors using the exact same strategy applied to passive chatbots: dropping guidelines into a Markdown file and hoping the underlying large language model complies.
That setup works fine until it doesn’t. A directive in a configuration file stating “never read .env” functions purely as guidance. A capable model will usually honor it, but guidance is never a hard boundary. The model ultimately decides whether to follow a given sentence, and nothing physically stops it from drifting.
Across a regulated enterprise environment managing multiple repositories and diverse agent frameworks, prose is simply not an adequate control mechanism. Attack vectors exploit this exact vulnerability. When an agent optimizes strictly for code that compiles and passes the immediate functional test, it routinely reaches for the path of least resistance. Storing a token directly in localStorage is a single line of code. Storing it safely in an httpOnly cookie with correct security flags takes multiple lines and requires knowing precise implementation details. Trusting a raw request body is free; validating and narrowing every single input requires a robust schema.
Without architectural constraints, the agent writes code that works seamlessly in a demo environment but fails a rigorous security review. The core issue is timing. The security instruction usually arrives too late—during code review—after the insecure shape of the application has already been generated.
Enforcement in the Runtime, Not the Prose
To solve this systemic risk, engineering architecture must establish a strict division of labor: behavior is guidance, but security is mechanism. Anything that impacts core security or regulatory compliance must be enforced by systems the model cannot talk its way past. This means utilizing managed settings, lifecycle hooks, strict tool allowlists, and continuous integration gates rather than relying on paragraphs of text.
This reframes agent configuration from casual documentation into a formal trust boundary. The files that dictate which tools an agent can call, where it is permitted to deploy, and how it handles credentials now live directly in the execution path. They require the exact same treatment as Terraform scripts, Kubernetes manifests, or GitHub Actions pipelines: version control, peer review, and strict runtime enforcement.
The organizing principle is straightforward: the model proposes what to do, and the runtime decides whether it is actually allowed. The control plane sits directly between the agent and everything it touches. When the agent attempts an action, a pre-action lifecycle hook evaluates it. Only if the hook approves does the call reach an external tool, Model Context Protocol (MCP) server, or the network.
Securing the AI Software Supply Chain
Addressing these vulnerabilities demands a coordinated approach across the broader ecosystem. Anaconda is actively tackling these supply chain vectors through strategic acquisitions and architectural guardrails, ensuring that third-party packages and agent-generated code do not introduce silent vulnerabilities into production systems.
Effective control planes rely on specific design choices to prevent bypasses. One canonical source of truth prevents configuration drift. Instead of maintaining separate, hand-edited files for Claude, Cursor, and Copilot—which guarantees inconsistency and introduces exploitable gaps—policies are written once in a vendor-neutral format and used to generate the necessary per-agent files automatically.
Lifecycle hooks act as the primary enforcement plane. A pre-action hook intercepts tool usage before execution, parsing the target path, destination, and arguments. If the policy engine fails to load, it must fail closed for dangerous operations, immediately blocking the request rather than letting it pass through. High-risk actions—such as reading environment secrets, editing CI/CD configurations, deploying code, or establishing egress to unlisted network hosts—trigger a block unless paired with single-use human approval.
The 30-Second Verdict
Treating prompts as strict security guardrails is a recipe for silent breaches. Securing AI-generated code requires shifting from polite prose to hard runtime enforcement, containerized tool restrictions, and automated policy generation. As engineering teams roll out autonomous agents in production, the organizations that survive security reviews will be the ones that stop asking models nicely and start locking down their runtimes.
