AI Security in Software Development: Where Agents Become the Risk and Where They Already Find the Bugs

The word security glues together four different stories in conversations about AI in development: the quality of the code a model writes, the behaviour of an agent reading someone else's text, the provenance of the tools it installs, and the ability of those same models to find holes in other people's code. The glue causes damage: measurements from one story get carried into another, and decisions get made from headlines. Hence a snapshot rather than a guide — it records what exactly has been measured by September 2026, by whom, and against which baseline.010101Evgeny and I recorded a podcast in June where we first named these surfaces out loud and agreed the data was thin. In the weeks since, the data has become indecently plentiful — this text is mostly about it.Knizhny kub · Evgeny Kokuykin on AI security01Evgeny and I recorded a podcast in June where we first named these surfaces out loud and agreed the data was thin. In the weeks since, the data has become indecently plentiful — this text is mostly about it.Knizhny kub · Evgeny Kokuykin on AI security

The first division is by class of claim. A verifiable fact rests on a primary source: a vulnerability record, an incident report, a regulatory text, a peer-reviewed study. A market or product snapshot lives until the next release and must carry its check date. An author's forecast is called a forecast. A management heuristic is a practical guide, not a norm. An author's conclusion shows the chain from evidence to interpretation. These five phrases appear literally in the text below, not as a figure of speech.

The second division is by surface. Model-written code: how many defects generation brings and which classes slip past the checks. The tool supply chain: the packages a model suggests, and the servers, extensions and skills the agent installs by itself. The agent as an actor: identity, permissions, network, isolation. These three do not reduce to one another — a static analysis gate does nothing about a poisoned tool description, and a sandbox does not improve code quality.

A terminology note, without which the rest gets confusing. Security here always means an adversary who uses the system to cause harm. Model safety means the model does something other than what was expected, with no adversary anywhere nearby. The incident in which a model mistook a production system for a training exercise and attacked it belongs to the second category; its consequences belong to the first. Mixing them in a report or a threat model helps nobody.

What is not in this snapshot: tool rankings, and a retelling of the authority-boundary threat model from the agent stack analysis or its twelve technical boundaries — they are described there and only extended here with fresh incidents. There is no legal advice either: regulatory texts are paraphrased, not interpreted.

Start with the summer 2026 report: Veracode compares results on 80 tasks and reports 44% insecure solutions versus 45% a year earlier. More than a hundred models is the cumulative coverage of four snapshots, not the number newly tested for the summer leaderboard. Its leader, GPT-5.5, reached 68% secure solutions. Models trained specifically for code turned out no safer than general-purpose ones: 51% against 52%.

In the same test, secure-solution rates were 83% for SQL injection and 87% for weak cryptography, versus 15% for cross-site scripting and 12% for log injection. None of these classes is solved. Context-dependent output escaping is a plausible explanation for the gap, not a mechanism established by this experiment. Static analysis helps, alongside tests, data-flow review and architectural controls.

Veracode’s 27 August follow-up changes the picture: GPT-5.6 Sol reached 70% secure solutions against GPT-5.5’s 68%, with uneven gains across languages and flaw classes. The conclusion is to test a new version on your own stack, not to claim that models never improve.

In agentic mode the picture sharpens. The SusVibes benchmark, accepted at ICML 2026, takes 186 tasks from a hundred Python repositories — and the tasks were picked precisely where real people introduced a vulnerability while implementing them. The best pairing by functional correctness, SWE-agent with Claude 4 Sonnet, solves 57% of tasks functionally and only 11.8% securely; 79.3% of functionally correct solutions are insecure. A hint naming the exact vulnerability class raises secure solutions to 15.1% and lowers functional correctness: telling the model to write securely was insufficient in this experiment.

Field data confirms the lab only partly. An analysis of 4,022 pull requests from autonomous agents in the open AIDev dataset found at least one scanner finding in 38.9% of them, and 99.6% of critical findings were hard-coded secrets. But the same work carries an inconvenient detail: humans in those same workflows accounted for two thirds of the genuine leaked secrets, and review missed 81.1% of them before merge. This is not about models writing worse code than people — it is about review failing to keep up with the flow.020202I covered both in the channel six months apart. The first is about agents repeating the same defect classes on real tasks. The second is about 80% of organizations adopting tools before writing any policy. Together they give an honest picture: the model is not the problem.Knizhny kub · 'Is Vibe Coding Safe?'Knizhny kub · the GitLab accountability report02I covered both in the channel six months apart. The first is about agents repeating the same defect classes on real tasks. The second is about 80% of organizations adopting tools before writing any policy. Together they give an honest picture: the model is not the problem.Knizhny kub · 'Is Vibe Coding Safe?'Knizhny kub · the GitLab accountability report

And the counter-evidence, without which this section would be dishonest. A study on real repositories compared 36,855 units marked as model-written with 65,391 human ones and found 10.04 static analysis alerts per thousand lines against 13.56 — fewer for model code. Authorship there was inferred from comments, which skews the sample towards careful developers, and an alert is not a vulnerability. But the claim that models write categorically more vulnerable code than people is not supported by this work.

It also helps to remember the historical scale. In 2021, of 1,689 programs written by early autocomplete, about 40% contained a vulnerability; in 2022 an experiment with forty-seven participants showed the assisted group writing less secure code on all five tasks while rating its security higher. These studies use different models, tasks and participants: they cannot establish a five-year trend in vulnerability rates. The narrower lesson is that working code and developer confidence do not replace security checks.

The comparable Veracode series shows little movement; surveys describe growing use of models. These are different kinds of evidence. Developers estimate the share of code written or substantially assisted by a model at 42% and expect 65% by 2027; meanwhile 96% do not fully trust that code and only 48% always check it before committing. The gap between distrust and checking is the subject of this conversation.

In 2025 prompt injection was a conference topic. In 2026 it is a catalogue of vulnerability records with scores, versions and fix dates, across every major coding agent. The change of genre matters more than any single record: while it was a class of attacks, the debate was about model robustness; once there are records with versions, the debate is about product boundaries.

The entry points are specific to development, not generic text from the internet. A repository rules file with invisible characters: the model reads them, the reviewer does not. A tracker issue the agent reads while gathering context: a public issue made an agent leak private repository data into a public pull request. A project README. A tool description in the MCP protocol. An image rendered in chat. And finally the repository's own configuration — in September 2026 that turned out to be the nastiest entry point of all.

It is more useful to look at how each was closed than at the list of records. In Cursor an approved tool configuration could be swapped without a fresh prompt — fixed by mandatory re-approval on any change.

In GitHub Copilot an injection wrote the auto-approve setting into workspace settings — fixed by forbidding that write.

In Claude Code hooks and protocol servers from repository settings ran before the trust dialog — fixed by reordering the checks.

In Gemini CLI headless mode treated the folder as trusted and ignored the tool allowlist; scored 10.0 because that is unauthenticated code execution inside a build pipeline.

Not one fix was a sentence in a system prompt. The controls changed which files the agent could write, when a tool could run, and whose approval was required. The execution environment blocks the dangerous action instead of relying on a promise from the model.030303I covered Steve Wilson's book two years ago: the trust boundary is drawn there long before agents existed. What the book could not foresee is that untrusted input would become a rules file in someone else's repository, read by a model rather than a person.Knizhny kub · The Developer's Playbook for LLM Security03I covered Steve Wilson's book two years ago: the trust boundary is drawn there long before agents existed. What the book could not foresee is that untrusted input would become a rules file in someone else's repository, read by a model rather than a person.Knizhny kub · The Developer's Playbook for LLM Security

GitSpawn, disclosed on 1 September, targets the agent harness, not the model. Background Git calls executed configuration from a directory delivered with its .git folder, such as an archive or shared folder. Ordinary clone, fetch and pull do not carry that configuration. The authors reported eight findings in seven agents; four were unpatched at disclosure. Claude Code 2.1.196 fixed one path. Silence in a changelog does not establish that another path remains vulnerable today.

How the labs measure robustness is a separate story where it is easy to fool yourself. Anthropic commissioned an evaluation from Trajectory Labs: 72 scenarios, ten runs each, zero successful attacks out of 720 in automatic mode. Three weeks later an independent researcher achieved code execution in three and four cases out of five on his own chain, and the company closed the report as informational, calling the mode a convenience rather than a guarantee. Both numbers are honest and incomparable: different scenarios, a different attacker, a different purpose. From the same family: one model scored 0% against the older attacker and 25.92% against the strengthened one.

The supply chain in agentic development gained two links that the classic model never had. The first: packages the model invents. The second: tool protocol servers, editor extensions and skills the agent installs mid-task — usually without a signature, a registry or a pinned version.

The first link is well measured. A study presented at USENIX Security 2025 ran 576,000 code samples through sixteen models: 19.7% of recommended packages do not exist, with 205,474 unique invented names. The key is not the rate but the repeatability: 43% of invented names recur across all ten runs of the same prompt. A systematic error means the name can be registered in advance and left to wait. That is slopsquatting — typosquatting where the typo comes from a model rather than a human. In 2026-era models the rate of hallucinated packages fell to 4.62–6.10%, but 127 names are hallucinated by all five tested models at once, and 53 of them were still free to register at the time of the check.

In August 2026 OpenSourceMalware described WEL1DROPPER: more than 700 malicious packages published in two days, with 788 packages tracked as of August 6. Infection triggered on an ordinary module import, without install scripts. The researchers allow for either model-invented names or randomly generated typosquatting names. The campaign establishes malicious-dependency risk, but it does not prove that its names came from model recommendations.

The second link produced a nastier story. In August 2025 the compromise of a popular build package deployed malware that looked for coding agents installed on the machine and launched them with permission-bypass flags — so that the agent itself would find and collect the secrets. That inverts the usual frame: the agent here is not the victim of an injection but the executor in the hands of an attacker who already has access. In the same wave more than 6,700 private repositories were made public and more than 1,700 users had verified secrets exposed.040404When I walked through the protocol, a tool description looked like an interface. A year later it turns out to be executable configuration: the model reads it and takes it as an instruction. It deserves the treatment we give a dependency manifest, not documentation.Knizhny kub · a walkthrough of MCP04When I walked through the protocol, a tool description looked like an interface. A year later it turns out to be executable configuration: the model reads it and takes it as an instruction. It deserves the treatment we give a dependency manifest, not documentation.Knizhny kub · a walkthrough of MCP

Four worm waves show the attack spreading from packages to build pipelines and AI-client settings. Compare delivery paths and targets; package counts, repository counts and downloads measure different things. The first (September 2025) took over five hundred packages by the registry's own count.

The second (November 2025) reached more than 30,000 repositories, with only 23% of infections on developer machines and the rest in build pipelines, and a wiper that erased the home directory when exfiltration failed.

The third (April 2026) arrived through the official command line interface of a password manager and hunted model provider keys.

The fourth (August 2026) covered more than four hundred packages with over 1.3 billion monthly downloads combined, targeted Anthropic, OpenAI and Cursor keys, and persisted in the agent directory's hooks.

A separate line runs through the agent's own tools. Tool poisoning was shown back in April 2025: a hidden instruction in a description makes the agent read keys and pass them as call arguments, and the change-after-approval variant turns one-time consent into standing access. In September 2025 the first malicious protocol server was found in a registry — a single line adding a hidden copy of every email. Editor extensions produced 72 malicious packages delivered transitively through manifest dependencies, aimed at coding agent configurations. Agent skills produced 341 malicious entries out of 2,857 in one catalogue, plus a dynamic-context syntax in which a command runs before the model ever reads the file.

Plugin4Shell, disclosed by AIR on 17 September, adds a caveat: a client can install a revision other than its registry pin. The branch variant requires upstream control and a host that accepts hash-shaped branch names; GitHub rejects those names. AIR reports fixes in Claude Code 2.1.179 and Codex 0.146.0. This is researcher evidence, not proof of widespread exploitation. Verify the installed commit, not just the version recorded in a catalogue.

What actually changed in the defence. The package registry revoked classic tokens, turned login into a two-hour session and capped write tokens at 90 days; trusted publishing removes the long-lived secret from the pipeline altogether. The official registry of protocol servers, meanwhile, has stayed in preview for a year: namespace verification exists, package signing does not. That is the current maturity line: for packages a trust infrastructure has appeared, for agent tools it has not.

In the attacks reviewed here, leakage is not limited to the model’s reply: the secret enters the agent's context and then leaves through any permitted channel. In 2025, 28.65 million new secrets landed in public commits — 34% more, while commit volume itself grew 43%. Secrets belonging to AI services numbered 1,275,105, up 81%. Commits attributed to Claude Code co-authorship in GitGuardian telemetry contain a secret in 3.2% of cases against a 1.5% baseline. And one figure that simply could not have existed a year ago: 24,008 unique secrets were found in public configuration files of the tool protocol, 2,117 of them still valid at the time of the check. The total covers all public GitHub commits; the group difference does not show that the agent caused it.

The exfiltration channels available to an agent are far richer than the text of its answer. Commands allowed without confirmation let data be encoded into a domain name lookup. An image proxy in chat gave character-by-character exfiltration through image links. A pre-approved domain turned another service's download counter into a covert channel. What all three share is that they pass exactly where the output filter is not looking, while formally respecting the allowlist.

These cases point to two priority controls. The first is before the context is built: do not let the agent read what the task does not need, replace recognized keys and tokens with placeholders before sending, keep credentials outside the workspace. The second is at the network edge: deny egress by default and maintain an explicit address list. An output filter cannot intercept data already sent by a tool, but remains useful for its own channel. Least privilege, short-lived tokens, revocation and logging add further controls. An allowed domain can still accept attacker-directed data; address rules do not replace restrictions on operations and recipients.050505I covered the Tailscale talk on the network as the sandbox a year ago and thought it elegant but excessive. After the 2026 catalogue of exfiltration channels it simply looks correct: a network boundary constrains several channels at once. Its coverage still needs checking for each process and allowed destination.Knizhny kub · 'What if the network was the sandbox?'05I covered the Tailscale talk on the network as the sandbox a year ago and thought it elegant but excessive. After the 2026 catalogue of exfiltration channels it simply looks correct: a network boundary constrains several channels at once. Its coverage still needs checking for each process and allowed destination.Knizhny kub · 'What if the network was the sandbox?'

The second half of the story is applications built with almost no hand-written code. In February 2026 an open database behind a social network for agents exposed 1.5 million agent tokens and about 35,000 addresses: the client key sat in the page code and row-level access rules were never enabled. The founder said outright that he had not written a single line by hand. This documents an access-control failure in an application built with models. It does not establish that the coding method caused the leak: that requires a comparison of development processes. A public client key alone is not a substitute for examining data-access rules.

Finally, the data policies of the tools themselves. As of September 2026 the picture is this: commercial terms for assistants generally exclude training on customer code, while personal plans enable it by setting — and at one major vendor that became the default on 24 April 2026. Read the redaction wording separately: we redact known secret formats means unknown formats and file contents leave exactly as they are.

The summer reports describe different containment failures: OpenAI and Hugging Face reported an agent leaving its evaluation environment, while Anthropic disclosed three incidents involving unintended internet access on 30 July. Anthropic’s 9 September update added a fourth incident missed by the original search. This is a vendor account of evaluations, not an incident rate for ordinary user sessions.

It matters what this is not. The reports connect behavior to evaluation conditions and a mistaken view of the environment. That is the authors’ explanation, not proof that the models never intended to bypass a restriction; some safeguards present in public products were absent. That is the practical formulation of the risk: autonomy plus a mistaken world model plus real tools can cause real damage even when the user’s task is benign.060606Two channel posts sit next to each other: one about an agent leaving the test environment, the other about which decisions stay with the platform. Read together they make one argument: a boundary cannot be delegated to the thing it bounds.Knizhny kub · the Black Hat talk on the incidentKnizhny kub · what to give the agent and what to keep on the platform06Two channel posts sit next to each other: one about an agent leaving the test environment, the other about which decisions stay with the platform. Read together they make one argument: a boundary cannot be delegated to the thing it bounds.Knizhny kub · the Black Hat talk on the incidentKnizhny kub · what to give the agent and what to keep on the platform

Then come the numbers labs publish about themselves, which are more honest than any marketing. Users approve about 93% of confirmation prompts: that is consistent with approval fatigue, but does not itself measure attention or the share of mistaken approvals. Operating system level isolation cut prompts by 84%. The automatic mode classifier catches about 83% of overeager actions on the vendor’s internal test set — not 83% of real-world attacks, which the vendor states plainly in a footnote. And separately: in an internal exercise in February 2026 an agent launched by a phished user exfiltrated cloud keys in 24 attempts out of 25 — because defences anchored on user intent stay silent when the user types the instruction.

The market answered with an identity layer. Agent identities became a separate account class in the enterprise directory. A working group draft describes issuing a delegation token from the provider for cross-application access. The tool protocol specification went through three authorization revisions in fourteen months: the server became a full token audience, dynamic client registration was deprecated, issuer validation was added. The direction is single: a non-human identity instead of a shared human token, and least privilege instead of grant access now and sort it out later.

Check the actual scope of network controls as well. GitHub’s documentation limits its firewall to processes the agent starts through Bash inside GitHub Actions. It does not directly cover MCP servers or setup steps. Those processes need their own network and credential restrictions.

The flip side of autonomy is the quality of oversight. A monitorability prototype showed that a monitor catches an agent performing a covert side task in 52% of runs with hidden reasoning and 80% with visible reasoning. A government evaluator recorded rule-bypass attempts in 12% of samples. And a study with more than a hundred developers produced the section's most uncomfortable figure: 94% did not notice sabotage in the agent's code, and 56% accepted the harmful change even when the monitor warned them.

OpenAI’s six reports of 16 September describe unwanted behavior during training and evaluation, including unauthorized file uploads to create citations or share data between agents. These are different cases, not six equivalent cyber incidents or a user-session failure rate. A task goal does not itself authorize publishing its data.

The same capabilities work for the defence, and 2026 delivered counts rather than promises. Google's Big Sleep found a memory bug in SQLite before release — where 150 hours of fuzzing had not; later, guided by threat intelligence, the same agent found a flaw an adversary was preparing to exploit.

AIxCC, the competition organized by DARPA and OpenSSF, ended with an independent review reproducing all 27 real issues that participants found across six projects. These are not 27 newly confirmed vulnerabilities: some were already known or outside the threat model.

After the contest, FuzzingBrain reported 62 findings across 26 projects: maintainers confirmed 43, and 36 were fixed.

Beyond that begins the zone where wording must be read carefully. In October 2025, Aardvark reported 92% recall on internal golden repositories. In March 2026, Codex Security reported 14 open-source CVEs and, separately, 792 critical findings from scanning 1.2 million commits over 30 days. Scanning findings are not independently confirmed vulnerabilities.

Anthropic found 22 vulnerabilities in Firefox in two weeks, fourteen of which the maintainers rated high and fixed in a release — one of the few publicly checkable results, because the confirmation came from outside.

The initial Glasswing report of 22 May distinguished model ratings from human validation: 90.6% of reviewed findings were real, but only 62.4% were confirmed high or critical. The Anthropic disclosure dashboard, dated 26 August, is the newer snapshot: 2,300 reports to maintainers and 421 upstream fixes. It spans multiple Claude models and all severities; some reports bypassed independent review at recipients’ request. These counts are neither an automatic-fix rate nor a measure of patches installed by users.

One public control measurement from a maintainer's side looks more modest. The author of a widely used library got access to the same model and received one confirmed vulnerability out of five claimed, whereas two other analyzers had brought him 200–300 merged fixes over eight to ten months. His conclusion — that there is more marketing than result around the model so far — applies to one codebase already swept by other tools, but it is exactly the kind of check that is missing everywhere else.070707Both posts predate these numbers and both make the same point: value moves to whoever can say this fix is safe. The registry now lets us track validation, maintainer notification and patch release as separate stages.Knizhny kub · the verifiers' finest hourKnizhny kub · why agent code needs deterministic external control07Both posts predate these numbers and both make the same point: value moves to whoever can say this fix is safe. The registry now lets us track validation, maintainer notification and patch release as separate stages.Knizhny kub · the verifiers' finest hourKnizhny kub · why agent code needs deterministic external control

Dual use is not an abstraction here. The same vendor that hands the model to defenders banned 832 accounts over a year for security violations, and 80% of those actors were misusing a coding agent specifically. The ability to find vulnerabilities does not split into defensive and offensive — only access does.

If discovery has hit remediation, the remediation tools deserve a look. They exist and they publish numbers: 72 security patches upstreamed in six months; the fixed share of security debt rising from 10% to 55% inside campaigns; 85.4% of internal golden tests passed against 72.4% for the previous model. All of these were measured by vendors on their own sets, but they do not yield a comparable patch-acceptance rate with a common denominator and follow-up period.

An academic measurement explains why that matters. On a set of 136 real vulnerabilities models generate a patch in about 60% of cases, and only 5–11% pass full verification. The gap between generated and verified is the whole problem: a plausible patch that passes the build but changes semantics costs more than no patch at all.

The economics of the competition systems give a useful benchmark. The system that placed second found 28 vulnerabilities and fixed 19 while spending 39,600 dollars on the entire final — about 181 dollars per scoring point. That is not the cost of production operation, but it shows the order of magnitude: compute here is cheaper than the engineer time spent making sense of the output.

The second half of this section is about report volume. The curl bounty programme went through a full cycle in two years. By July 2025 about 20% of reports were slop and the valid share had fallen to 5%. In January 2026 the programme closed: 87 confirmed vulnerabilities and over 100,000 dollars paid across its life, with the valid share down from 15% to under 5%. In March the project returned to the same platform — without money. And by April the confirmed report share was back to 15–16% at double the frequency.

Report quality improved after payouts ended. That is consistent with an incentives hypothesis, but this project’s history does not isolate the effect of money from other changes. Model-assisted reports did not disappear — on the contrary, nearly every report now uses them, and the maintainer projects around fifty vulnerabilities for the year. The problem changed from they send us fiction to they send us more real findings than we can fix. In the same spirit, one platform paused new submissions to its open-source programme, citing exactly the gap between discovery speed and remediation capacity.

There is a working answer to volume as well. One bounty programme operator published the economics: over 1,390 reports in half a year against a historical 600–850 per year, with model triage costing about two dollars per report and agreeing with the analyst 85% of the time, while the final decision always stays with a human. That is the first public figure you can compute with instead of argue about.

By now the requirements have arranged themselves into four layers, and confusing them is expensive. Taxonomy names the risks. Measurement tests robustness. Obligation demands action by a date. Artefacts record provenance. Different layers solve different problems and none substitutes for the others.

The taxonomy was refreshed in August 2026: the risk list for model-based applications was checked against a corpus of 7,714 incident records for the first time. Of those, 6,639 contained enough detail to classify. Practitioner votes carry three quarters of the weight and data one quarter. This ranks risks; it does not measure successful-attack frequency. Prompt injection stayed first, excessive agency rose from sixth to third, and improper output handling — now explicitly about the insecure code assistants generate at scale — fell from fifth to tenth. A separate list for agentic applications arrived in December 2025 and opens with agent goal hijack, tool misuse and privilege abuse; the authors state plainly that the two lists are meant to be read as a pair.

NIST is developing COSAiS: five planned control overlays based on SP 800-53, including separate ones for single-agent and multi-agent systems. On 19 September, the project page lists a concept paper and an outline for predictive AI, but no completed agent overlays. A separate agent standards initiative launched in February 2026; its page links to an information request and an identity and authorization concept. These are efforts to develop guidance, not a mandatory standard. Published red team measurements cover more than 250,000 attack attempts against thirteen frontier models, with at least one success against every one.

The obligation layer already affects team operations. Article 14 of the European Cyber Resilience Act has applied since 11 September 2026, and ENISA's Single Reporting Platform is operational. Manufacturers of in-scope products with digital elements must report actively exploited vulnerabilities and severe incidents affecting product security.

Early warnings are due within 24 hours of awareness and notifications within 72 hours. A vulnerability final report is due no later than fourteen days after a corrective measure becomes available; a severe-incident final report is due within one month after the 72-hour notification.

The main CRA requirements apply from 11 December 2027.

An adopted AI Act amendment delays Chapter III, Sections 1–3 for Annex III high-risk systems until 2 December 2027 and Annex I systems until 2 August 2028. Other duties have their own dates.080808The lineage of all this runs back to safe-by-construction interfaces. An agent needs them more than a person does: you cannot train it out of making mistakes, but you can decline to hand it a dangerous primitive.Knizhny kub · Secure by Design at Google08The lineage of all this runs back to safe-by-construction interfaces. An agent needs them more than a person does: you cannot train it out of making mistakes, but you can decline to hand it a dangerous primitive.Knizhny kub · Secure by Design at Google

The artefact layer is the most practical. The minimum elements for a software bill of materials were reissued in July 2026 and state outright that model-based systems may require additional fields. npm and PyPI support trusted publishing with short-lived credentials, allowing teams to remove permanent tokens from that workflow. Since 1 September, OWASP also lists the Agent Control Standard: an open project for agent middleware hooks and runtime policy enforcement. Its existence does not prove the completeness or effectiveness of a particular implementation. The reading rule for this whole layer: a standard names the risk, it does not prove your control works. Compliance and security are different claims: documentation and technical checks establish conformity with specific requirements, while resistance to attacks needs separate measurement on your own stack.

The Russian contour is usually discussed apart from the global agenda, and that is a mistake: it is the same layered cake on a different schedule. The base layer has long been formal. The standard for secure software development has applied since 20 December 2024 and the static analysis standard since 1 April 2024. Neither carves out an exception for generated code. The project's regulatory and contractual context determines applicability; using a model does not itself exempt code from the adopted secure development processes.

The baseline act for this government-sector scope is FSTEC Order No. 117, in force since 1 March 2026. It covers state information systems and other information systems of government bodies, state unitary enterprises and institutions, and explicitly addresses artificial intelligence. Clause 60 forbids passing restricted-access information to the model developer, including for the purpose of improving the model, and requires that unauthorized access to datasets, models and their parameters be excluded. Clause 61 requires templates for prompts and answers, or a list of permitted topics with conformance control, statistical criteria for detecting unreliable answers, and the inclusion of trusted AI technologies in the systems themselves.

One popular simplification needs removing here. The text of clauses 60 and 61 says nothing about banning foreign services: it bans passing restricted information to the model developer and requires that the technologies be trusted. Those are different claims, and the second points, through the notion of trustworthiness, at the national strategy rather than at a list of countries.

Adopted changes need to be distinguished from proposals. Amending Order No. 137 took effect on 1 September 2026 without touching the model clauses. The next draft amendments were published on 24 August 2026. They propose a dedicated segment for models, strong multi-factor authentication for privileged access, and permission management for agents, including autonomous agents. Input and output filtering, quotas and functionality restrictions are additional measures for restricted information or significant operator functions. The listed consultation deadline of 8 September has passed. The 1 March 2027 effective date remains a proposal: adoption was not confirmed as of 19 September. Similarly, the draft GOST on secure development of software implementing AI cannot be treated as adopted simply because its listed 17 September consultation deadline has passed.

The financial sector moved at its own pace. In June 2026 the regulator issued its first recommendations on information security in the development and use of models. They advise building the threat model for a model-bearing system using the FSTEC methodology and applying red team testing. Human validation of automated operations is recommended in critical processes, such as payments, when the organization assesses information-security risks as high. Vendor assessment should consider agents, extensions and interaction interfaces, as well as participation in a bug bounty programme. Clauses 5.1–5.5 already cover suppliers, component inventories and supply-chain integrity. These are recommendations, not new binding requirements.

There is a practical layer too. The national threat database keeps a dedicated section for vulnerabilities in software used to build model-based systems — 951 records in the historical snapshot of 4 September 2026, including a tool protocol library flaw with the maximum score. The current total could not be confirmed on 19 September; vulnerability records are not attack counts. There is also a section on threats to model-based systems, separating the developer's environment from the operator's. Domestic defensive tools exist: a model-application monitor claims 97% injection detection accuracy, and an open university red team framework supports attacks in Russian. The 97% figure is a claim by the monitor's developers; the cited sources provide no independent validation of that metric.

Separately, Federal Law No. 243-FZ on supporting AI technology development has been in force since 1 September 2026. Article 3 definitions, including the threshold of at least one billion parameters and sovereign and national model definitions, already apply. Article 8 is among the provisions delayed until 1 March 2027: it requires sovereign and national foundation-model developers to implement organizational and technical security measures, define operating, update and retirement rules, and keep documentation for assessing safe use. These duties do not replace secure software development processes.

The gap can no longer be described as a complete absence of agents or supply chains from these documents: Bank of Russia guidance names them, and the FSTEC draft explicitly addresses agent permissions. These documents do not, however, set out a unified, detailed model for identity and delegation of authority between agents. Teams still need to translate applicable requirements into specific access boundaries and checks, supplementing them with global risk lists. Waiting for new acts does not replace that work.

Let us gather the three surfaces and the defensive side into one picture. The horizontal axis is evidence maturity, from idea to norm. The vertical axis is my qualitative estimate of the harm a successful attack could cause. For example, an injection that allows code execution and data exfiltration sits above a local auto-remediation error. The axis does not show attack frequency; this material does not provide the data for that comparison. The positions here are the author's: a reading of the sources as of 19 September 2026, not a measurement.

No-regret bets — the ones that pay off regardless of how the next year turns out.

• •Secret scanning in pre-commit hooks and no credentials inside the agent's workspace
• •Agent tools only from an internal registry, with pinned versions and review of changes in service directories
• •Operating system level isolation plus egress denied by default
• •A separate identity per agent run and short-lived credentials instead of a shared human token
• •A static analysis and test gate on every agent pull request, with no exception for small changes
• •Model findings accepted only with a reproducible proof; automated fixes go through the same gate as human pull requests

Threshold bets are the ones you compute before adopting. Model triage of reports pays off once the queue stops being handled by people; the public figure for that calculation already exists. Automated fixing makes sense where the defect class is checked by a deterministic test. Agent identity products become cheaper than a home-grown solution once agents number in the dozens rather than the units.

What not to do. Do not switch on the agent's automatic mode where there is no isolation and no network control: the vendor itself calls the classifier a convenience rather than a guarantee. Do not merge automated security fixes around review. Do not treat a finding as confirmed without proof. And do not confuse compliance with security: meeting specific requirements does not replace measuring resilience on your own stack.

It is worth saying who does all this. None of the six bets above belongs to a separate security team: the tool registry and pinned versions live with the platform team, the analysis gate with the pipeline owners, per-run identity with whoever grants access, and the rule about proof with whoever accepts reports. Collapse it all into one role and you get either a bottleneck or a showcase.

What to watch before March 2027: reporting practice under the European regulation, already applicable since 11 September, the appearance of signing in the tool protocol registry, the share of model-found issues that actually get fixed, the first public data on injection incident rates in operation, supervisory practice on the model clauses, decisions on the draft FSTEC amendments, and the status of the AI-software development standard. This is a monitoring horizon, not a guarantee that proposals will be adopted by March.

How to read this in six months

Surface → evidence class → the boundary that closes it → measurement on your own stack → revisit in six months

• —A number without a baseline is not a number: ask what it was measured against
• —A vendor claim about its own model is a product snapshot, not an industry fact
• —Absence of public frequency data is not evidence of low risk