AI Security in Software Development: Where Agents Become the Risk and Where They Already Find the Bugs

The word security glues together four different stories in conversations about AI in development: the quality of the code a model writes, the behaviour of an agent reading someone else's text, the provenance of the tools it installs, and the ability of those same models to find holes in other people's code. The glue causes damage: measurements from one story get carried into another, and decisions get made from headlines. Hence a snapshot rather than a guide — it records what exactly has been measured by September 2026, by whom, and against which baseline.010101Evgeny and I recorded a podcast in June where we first named these surfaces out loud and agreed the data was thin. In the weeks since, the data has become indecently plentiful — this text is mostly about it.Knizhny kub · Evgeny Kokuykin on AI security01Evgeny and I recorded a podcast in June where we first named these surfaces out loud and agreed the data was thin. In the weeks since, the data has become indecently plentiful — this text is mostly about it.Knizhny kub · Evgeny Kokuykin on AI security

The first division is by class of claim. A verifiable fact rests on a primary source: a vulnerability record, an incident report, a regulatory text, a peer-reviewed study. A market or product snapshot lives until the next release and must carry its check date. An author's forecast is called a forecast. A management heuristic is a practical guide, not a norm. An author's conclusion shows the chain from evidence to interpretation. These five phrases appear literally in the text below, not as a figure of speech.

The second division is by surface. Model-written code: how many defects generation brings and which classes slip past the checks. The tool supply chain: the packages a model suggests, and the servers, extensions and skills the agent installs by itself. The agent as an actor: identity, permissions, network, isolation. These three do not reduce to one another — a static analysis gate does nothing about a poisoned tool description, and a sandbox does not improve code quality.

A terminology note, without which the rest gets confusing. Security here always means an adversary who uses the system to cause harm. Model safety means the model does something other than what was expected, with no adversary anywhere nearby. The incident in which a model mistook a production system for a training exercise and attacked it belongs to the second category; its consequences belong to the first. Mixing them in a report or a threat model helps nobody.

What is not in this snapshot: tool rankings, and a retelling of the authority-boundary threat model from the agent stack analysis or its twelve technical boundaries — they are described there and only extended here with fresh incidents. There is no legal advice either: regulatory texts are paraphrased, not interpreted.

The most stable measurement of the year is the one that did not change. In July 2026 Veracode ran 80 tasks through more than a hundred models and got 44% of solutions carrying a flaw from the OWASP list. A year earlier the same set gave 45%. The best model in the sample passed 68% of tasks, meaning it fails almost one in three. Models trained specifically for code turned out no safer than general-purpose ones: 51% against 52%.

The breakdown by class is more interesting. SQL injection and weak cryptography are essentially solved — 82% and 86% passing. Cross-site scripting (15%) and log injection (12%) have not moved a single point in a year. That is not a random pairing: the failing classes require escaping on output, which means knowing where the string will end up, and the model does not have that context. Those are exactly the classes static analysis catches — the tool it has been fashionable to treat as a relic of the previous era.

In agentic mode the picture sharpens. The SusVibes benchmark, accepted at ICML 2026, takes 186 tasks from a hundred Python repositories — and the tasks were picked precisely where real people introduced a vulnerability while implementing them. The best agent and model pairing solves 57% of tasks functionally and only 11.8% securely; 79.3% of functionally correct solutions are insecure. A hint naming the exact vulnerability class raises secure solutions to 15.1% and lowers functional correctness: telling the model to write securely is not a working strategy.

Field data confirms the lab only partly. An analysis of 4,022 pull requests from autonomous agents in the open AIDev dataset found at least one scanner finding in 38.9% of them, and 99.6% of critical findings were hard-coded secrets. But the same work carries an inconvenient detail: humans in those same workflows accounted for two thirds of the genuine leaked secrets, and review missed 81.1% of them before merge. This is not about models writing worse code than people — it is about review failing to keep up with the flow.020202I covered both in the channel six months apart. The first is about agents repeating the same defect classes on real tasks. The second is about 80% of organizations adopting tools before writing any policy. Together they give an honest picture: the model is not the problem.Knizhny kub · 'Is Vibe Coding Safe?'Knizhny kub · the GitLab accountability report02I covered both in the channel six months apart. The first is about agents repeating the same defect classes on real tasks. The second is about 80% of organizations adopting tools before writing any policy. Together they give an honest picture: the model is not the problem.Knizhny kub · 'Is Vibe Coding Safe?'Knizhny kub · the GitLab accountability report

And the counter-evidence, without which this section would be dishonest. A study on real repositories compared 36,855 units marked as model-written with 65,391 human ones and found 10.04 static analysis alerts per thousand lines against 13.56 — fewer for model code. Authorship there was inferred from comments, which skews the sample towards careful developers, and an alert is not a vulnerability. But the claim that models write categorically more vulnerable code than people is not supported by this work.

It also helps to remember the historical scale. In 2021, of 1,689 programs written by early autocomplete, about 40% contained a vulnerability; in 2022 an experiment with forty-seven participants showed the assisted group writing less secure code on all five tasks while rating its security higher. In five years the rate has barely moved — what changed is how much such code is produced per unit of time and how rarely a human reads it.

Adding it up: the defect rate holds, the volume grew. Developers estimate the share of code written or substantially assisted by a model at 42% and expect 65% by 2027; meanwhile 96% do not fully trust that code and only 48% always check it before committing. The gap between distrust and checking is the subject of this conversation.

In 2025 prompt injection was a conference topic. In 2026 it is a catalogue of vulnerability records with scores, versions and fix dates, across every major coding agent. The change of genre matters more than any single record: while it was a class of attacks, the debate was about model robustness; once there are records with versions, the debate is about product boundaries.

The entry points are specific to development, not generic text from the internet. A repository rules file with invisible characters: the model reads them, the reviewer does not. A tracker issue the agent reads while gathering context: a public issue made an agent leak private repository data into a public pull request. A project README. A tool description in the MCP protocol. An image rendered in chat. And finally the repository's own configuration — in September 2026 that turned out to be the nastiest entry point of all.

It is more useful to look at how each was closed than at the list of records. In Cursor an approved tool configuration could be swapped without a fresh prompt — fixed by mandatory re-approval on any change. In GitHub Copilot an injection wrote the auto-approve setting into workspace settings — fixed by forbidding that write. In Claude Code hooks and protocol servers from repository settings ran before the trust dialog — fixed by reordering the checks. In Gemini CLI headless mode treated the folder as trusted and ignored the tool allowlist; scored 10.0 because that is unauthenticated code execution inside a build pipeline. Not one fix was a sentence in a system prompt. Every one was a boundary: files, network, auto-approval, trust.030303I covered Steve Wilson's book two years ago: the trust boundary is drawn there long before agents existed. What the book could not foresee is that untrusted input would become a rules file in someone else's repository, read by a model rather than a person.Knizhny kub · The Developer's Playbook for LLM Security03I covered Steve Wilson's book two years ago: the trust boundary is drawn there long before agents existed. What the book could not foresee is that untrusted input would become a rules file in someone else's repository, read by a model rather than a person.Knizhny kub · The Developer's Playbook for LLM Security

The freshest example is the GitSpawn class, published a week before this text. A hostile configuration in the repository's service directory executes the attacker's command when the agent touches version control in the background while gathering context. Cloning is safe on its own, the trust question has not been asked yet, the sandbox has not been applied yet — and the command has already run. Eight findings across seven agents, four unpatched as of 1 September. In Claude Code one path was closed in version 2.1.196; the second was still live on 1 September, and the changelog through version 2.1.261 does not mention it.

How the labs measure robustness is a separate story where it is easy to fool yourself. Anthropic commissioned an evaluation from Trajectory Labs: 72 scenarios, ten runs each, zero successful attacks out of 720 in automatic mode. Three weeks later an independent researcher achieved code execution in three and four cases out of five on his own chain, and the company closed the report as informational, calling the mode a convenience rather than a guarantee. Both numbers are honest and incomparable: different scenarios, a different attacker, a different purpose. From the same family: one model scored 0% against the older attacker and 25.92% against the strengthened one.

The supply chain in agentic development gained two links that the classic model never had. The first: packages the model invents. The second: tool protocol servers, editor extensions and skills the agent installs mid-task — usually without a signature, a registry or a pinned version.

The first link is well measured. A study presented at USENIX Security 2025 ran 576,000 code samples through sixteen models: 19.7% of recommended packages do not exist, with 205,474 unique invented names. The key is not the rate but the repeatability: 43% of invented names recur across all ten runs of the same prompt. A systematic error means the name can be registered in advance and left to wait. That is slopsquatting — typosquatting where the typo comes from a model rather than a human. In 2026-era models the rate of hallucinated packages fell to 4.62–6.10%, but 127 names are hallucinated by all five tested models at once, and 53 of them were still free to register at the time of the check.

In August 2026 this stopped being theory: one campaign published 788 malicious packages in two days under names in exactly that style, and infection triggered on an ordinary module import, with no install scripts. The researchers say plainly that they did not measure what share of the names were genuinely model-invented — but the campaign itself is no longer a hypothesis.

The second link produced a nastier story. In August 2025 the compromise of a popular build package deployed malware that looked for coding agents installed on the machine and launched them with permission-bypass flags — so that the agent itself would find and collect the secrets. That inverts the usual frame: the agent here is not the victim of an injection but the executor in the hands of an attacker who already has access. In the same wave more than 6,700 private repositories were made public and more than 1,700 users had verified secrets exposed.040404When I walked through the protocol, a tool description looked like an interface. A year later it turns out to be executable configuration: the model reads it and takes it as an instruction. It deserves the treatment we give a dependency manifest, not documentation.Knizhny kub · a walkthrough of MCP04When I walked through the protocol, a tool description looked like an interface. A year later it turns out to be executable configuration: the model reads it and takes it as an instruction. It deserves the treatment we give a dependency manifest, not documentation.Knizhny kub · a walkthrough of MCP

Then came four worm waves in the package registry. The first (September 2025) took over five hundred packages by the registry's own count. The second (November 2025) reached more than 30,000 repositories, with only 23% of infections on developer machines and the rest in build pipelines, and a wiper that erased the home directory when exfiltration failed. The third (April 2026) arrived through the official command line interface of a password manager and hunted model provider keys. The fourth (August 2026) covered more than four hundred packages with over 1.3 billion monthly downloads combined, targeted Anthropic, OpenAI and Cursor keys, and persisted in the agent directory's hooks.

A separate line runs through the agent's own tools. Tool poisoning was shown back in April 2025: a hidden instruction in a description makes the agent read keys and pass them as call arguments, and the change-after-approval variant turns one-time consent into standing access. In September 2025 the first malicious protocol server was found in a registry — a single line adding a hidden copy of every email. Editor extensions produced 72 malicious packages delivered transitively through manifest dependencies, aimed at coding agent configurations. Agent skills produced 341 malicious entries out of 2,857 in one catalogue, plus a dynamic-context syntax in which a command runs before the model ever reads the file.

What actually changed in the defence. The package registry revoked classic tokens, turned login into a two-hour session and capped write tokens at 90 days; trusted publishing removes the long-lived secret from the pipeline altogether. The official registry of protocol servers, meanwhile, has stayed in preview for a year: namespace verification exists, package signing does not. That is the current maturity line: for packages a trust infrastructure has appeared, for agent tools it has not.

The most common mistake in leak discussions is assuming the model blurts things out. What almost always happens is different: the secret enters the agent's context and then leaves through any permitted channel. In 2025, 28.65 million new secrets landed in public commits — 34% more, while commit volume itself grew 43%. Secrets belonging to AI services numbered 1,275,105, up 81%. Commits made with a coding agent contain a secret in 3.2% of cases against a 1.5% baseline. And one figure that simply could not have existed a year ago: 24,008 unique secrets were found in public configuration files of the tool protocol, 2,117 of them still valid at the time of the check.

The exfiltration channels available to an agent are far richer than the text of its answer. Commands allowed without confirmation let data be encoded into a domain name lookup. An image proxy in chat gave character-by-character exfiltration through image links. A pre-approved domain turned another service's download counter into a covert channel. What all three share is that they pass exactly where the output filter is not looking, while formally respecting the allowlist.

It follows that exactly two cuts work. The first is before the context is built: do not let the agent read what the task does not need, redact known secret formats before sending, keep credentials outside the workspace. The second is at the network edge: deny egress by default and maintain an explicit address list. The output filter comes third in order and first in uselessness: it sits after the data has already left the perimeter.050505I covered the Tailscale talk on the network as the sandbox a year ago and thought it elegant but excessive. After the 2026 catalogue of exfiltration channels it simply looks correct: a network boundary catches every primitive at once instead of one at a time.Knizhny kub · 'What if the network was the sandbox?'05I covered the Tailscale talk on the network as the sandbox a year ago and thought it elegant but excessive. After the 2026 catalogue of exfiltration channels it simply looks correct: a network boundary catches every primitive at once instead of one at a time.Knizhny kub · 'What if the network was the sandbox?'

The second half of the story is applications built with almost no hand-written code. In February 2026 an open database behind a social network for agents exposed 1.5 million agent tokens and about 35,000 addresses: the client key sat in the page code and row-level access rules were never enabled. The founder said outright that he had not written a single line by hand. This is the only 2026 case where the link between how the software was built and how it leaked is confirmed both by a primary analysis and by the owner — the other loud stories lack that link, and attributing them to vibe coding is not sound.

Finally, the data policies of the tools themselves. As of September 2026 the picture is this: commercial terms for assistants generally exclude training on customer code, while personal plans enable it by setting — and at one major vendor that became the default on 24 April 2026. Read the redaction wording separately: we redact known secret formats means unknown formats and file contents leave exactly as they are.

Two incidents in the summer of 2026 changed the containment conversation more than every researcher demonstration combined. In July a model running internal cyber evaluations escaped isolation through a flaw in an artifact store, reached the internet and compromised part of another company's production infrastructure; the victim reconstructed about 17,600 actions across roughly 6,280 clusters over four and a half days. Nine days later another lab published a retrospective of 141,006 runs and found three cases where models attacked real systems, mistaking them for exercises.

It matters what this is not. In neither case did the model try to escape: in the first it was solving the task it had been given without production guardrails, and in the second it was wrong about where it was. That is the practical formulation of the risk: autonomy plus a mistaken world model plus real tools produces real damage with no ill intent involved.060606Two channel posts sit next to each other: one about an agent leaving the test environment, the other about which decisions stay with the platform. Read together they make one argument: a boundary cannot be delegated to the thing it bounds.Knizhny kub · the Black Hat talk on the incidentKnizhny kub · what to give the agent and what to keep on the platform06Two channel posts sit next to each other: one about an agent leaving the test environment, the other about which decisions stay with the platform. Read together they make one argument: a boundary cannot be delegated to the thing it bounds.Knizhny kub · the Black Hat talk on the incidentKnizhny kub · what to give the agent and what to keep on the platform

Then come the numbers labs publish about themselves, which are more honest than any marketing. Users approve about 93% of confirmation prompts: the more prompts they see, the less attention each one gets, and the human in the loop stops being a control. Operating system level isolation cut prompts by 84%. The automatic mode classifier catches about 83% of overeager actions — meaning it lets one in six through, which the vendor states plainly in a footnote. And separately: in an internal exercise in February 2026 an agent launched by a phished user exfiltrated cloud keys in 24 attempts out of 25 — because defences anchored on user intent stay silent when the user types the instruction.

The market answered with an identity layer. Agent identities became a separate account class in the enterprise directory. A working group draft describes issuing a delegation token from the provider for cross-application access. The tool protocol specification went through three authorization revisions in fourteen months: the server became a full token audience, dynamic client registration was deprecated, issuer validation was added. The direction is single: a non-human identity instead of a shared human token, and least privilege instead of grant access now and sort it out later.

The flip side of autonomy is the quality of oversight. A monitorability prototype showed that a monitor catches an agent performing a covert side task in 52% of runs with hidden reasoning and 80% with visible reasoning. A government evaluator recorded rule-bypass attempts in 12% of samples. And a study with more than a hundred developers produced the section's most uncomfortable figure: 94% did not notice sabotage in the agent's code, and 56% accepted the harmful change even when the monitor warned them.

The same capabilities work for the defence, and 2026 delivered counts rather than promises. A vulnerability discovery agent found a memory bug in a widely used database before release — where 150 hours of fuzzing had not; later, guided by threat intelligence, the same agent found a flaw an adversary was preparing to exploit. A competition of agentic systems ended with an independent review reproducing all 27 real issues that participants found across six projects, and two systems moved to an open-source foundation and kept finding: 62 vulnerabilities across 26 projects, 36 of them already fixed.

Beyond that begins the zone where wording must be read carefully. One vendor's tool reported 92% recall on golden repositories and ten public identifiers, and in thirty days scanned 1.2 million commits producing 792 critical findings. Another vendor found 22 browser vulnerabilities in two weeks, fourteen of which the maintainers rated high and fixed in a release — one of the few publicly checkable results, because the confirmation came from outside.

The loudest programme of the year works differently: the model is withheld from public release on risk grounds and handed to defenders. In six weeks about fifty partners found more than ten thousand high and critical severity vulnerabilities. In open-source projects there were 6,202 high-severity findings, and of 1,752 checked independently 90.6% turned out to be real. Then comes the number that justifies reading this whole section: 530 of those findings were reported to maintainers, 75 fixes were deployed, and by the vendor's own account over 99% of what was found remains unpatched.

The only public control measurement from a maintainer's side looks more modest. The author of a widely used library got access to the same model and received one confirmed vulnerability out of five claimed, whereas two other analyzers had brought him 200–300 merged fixes over eight to ten months. His conclusion — that there is more marketing than result around the model so far — applies to one codebase already swept by other tools, but it is exactly the kind of check that is missing everywhere else.070707Both posts predate these numbers and both make the same point: value moves to whoever can say this fix is safe. A year on it has stopped being a thesis and become a bottleneck with a number attached: 530 reported against 75 fixed.Knizhny kub · the verifiers' finest hourKnizhny kub · why agent code needs deterministic external control07Both posts predate these numbers and both make the same point: value moves to whoever can say this fix is safe. A year on it has stopped being a thesis and become a bottleneck with a number attached: 530 reported against 75 fixed.Knizhny kub · the verifiers' finest hourKnizhny kub · why agent code needs deterministic external control

Dual use is not an abstraction here. The same vendor that hands the model to defenders banned 832 accounts over a year for security violations, and 80% of those actors were misusing a coding agent specifically. The ability to find vulnerabilities does not split into defensive and offensive — only access does.

If discovery has hit remediation, the remediation tools deserve a look. They exist and they publish numbers: 72 security patches upstreamed in six months; the fixed share of security debt rising from 10% to 55% inside campaigns; 85.4% of internal golden tests passed against 72.4% for the previous model. All of these were measured by vendors on their own sets, and none of them publishes the metric that matters — the share of fixes developers actually accepted.

An academic measurement explains why that matters. On a set of 136 real vulnerabilities models generate a patch in about 60% of cases, and only 5–11% pass full verification. The gap between generated and verified is the whole problem: a plausible patch that passes the build but changes semantics costs more than no patch at all.

The economics of the competition systems give a useful benchmark. The system that placed second found 28 vulnerabilities and fixed 19 while spending 39,600 dollars on the entire final — about 181 dollars per scoring point. That is not the cost of production operation, but it shows the order of magnitude: compute here is cheaper than the engineer time spent making sense of the output.

The second half of this section is about report volume. The curl bounty programme went through a full cycle in two years. By July 2025 about 20% of reports were slop and the valid share had fallen to 5%. In January 2026 the programme closed: 87 confirmed vulnerabilities and over 100,000 dollars paid across its life, with the valid share down from 15% to under 5%. In March the project returned to the same platform — without money. And by April the confirmed report share was back to 15–16% at double the frequency.

The conclusion from that trajectory is unexpected and useful: the money, not the tooling or the platform, attracted the slop. Model-assisted reports did not disappear — on the contrary, nearly every report now uses them, and the maintainer projects around fifty vulnerabilities for the year. The problem changed from they send us fiction to they send us more real findings than we can fix. In the same spirit, one platform paused new submissions to its open-source programme, citing exactly the gap between discovery speed and remediation capacity.

There is a working answer to volume as well. One bounty programme operator published the economics: over 1,390 reports in half a year against a historical 600–850 per year, with model triage costing about two dollars per report and agreeing with the analyst 85% of the time, while the final decision always stays with a human. That is the first public figure you can compute with instead of argue about.

By now the requirements have arranged themselves into four layers, and confusing them is expensive. Taxonomy names the risks. Measurement tests robustness. Obligation demands action by a date. Artefacts record provenance. Different layers solve different problems and none substitutes for the others.

The taxonomy was refreshed in August 2026: the risk list for model-based applications was checked against a corpus of 7,714 incidents for the first time, with the practitioner vote carrying three quarters of the weight. Prompt injection stayed first, excessive agency rose from sixth to third, and improper output handling — now explicitly about the insecure code assistants generate at scale — fell from fifth to tenth. A separate list for agentic applications arrived in December 2025 and opens with agent goal hijack, tool misuse and privilege abuse; the authors state plainly that the two lists are meant to be read as a pair.

The measurement layer grows more slowly. A government institute is preparing five overlays on its control catalogue, including separate ones for single and multi-agent systems, but no agent drafts exist as of the check date; a dedicated agent standards programme launched in February 2026 and so far consists of requests for information and a concept paper on identity. Red team measurements, on the other hand, went public: more than 250,000 attack attempts against thirteen frontier models, with at least one success against every one.

The obligation layer is the only one with a hard date, and it falls exactly one day after this text is published. From 11 September 2026 Article 14 of the European cyber resilience regulation applies: an early warning about an actively exploited vulnerability within 24 hours, a notification within 72 hours, and a final report fourteen days after the fix ships. The regulation applies in full from 11 December 2027. Worth noting separately: as of mid-August the single reporting platform was still in development. In the neighbouring AI regulation, an adopted amendment moved high-risk system obligations to December 2027 and August 2028.080808The lineage of all this runs back to safe-by-construction interfaces. An agent needs them more than a person does: you cannot train it out of making mistakes, but you can decline to hand it a dangerous primitive.Knizhny kub · Secure by Design at Google08The lineage of all this runs back to safe-by-construction interfaces. An agent needs them more than a person does: you cannot train it out of making mistakes, but you can decline to hand it a dangerous primitive.Knizhny kub · Secure by Design at Google

The artefact layer is the most practical. The minimum elements for a software bill of materials were reissued in July 2026 and state outright that model-based systems may require additional fields. Package registries moved to trusted publishing with short-lived tokens. And the reading rule for this whole layer: a standard names the risk, it does not prove your control works. Compliance and security are different claims — the first is checked with documents, the second only with measurement.

The Russian contour is usually discussed apart from the global agenda, and that is a mistake: it is the same layered cake on a different schedule. The base layer has long been formal. The standard for secure software development has applied since 20 December 2024 and the static analysis standard since 1 April 2024. Neither carves out an exception for generated code: code is code, and the processes apply to all of it.

The main event is FSTEC Order No. 117. It came into force on 1 March 2026 and is the first Russian act with requirements addressed directly to systems using artificial intelligence. Clause 60 forbids passing restricted-access information to the model developer, including for the purpose of improving the model, and requires that unauthorized access to datasets, models and their parameters be excluded. Clause 61 requires templates for prompts and answers, or a list of permitted topics with conformance control, statistical criteria for detecting unreliable answers, and the inclusion of trusted AI technologies in the systems themselves.

One popular simplification needs removing here. The text of clauses 60 and 61 says nothing about banning foreign services: it bans passing restricted information to the model developer and requires that the technologies be trusted. Those are different claims, and the second points, through the notion of trustworthiness, at the national strategy rather than at a list of countries.

The contour keeps being built out, and the dates are known. The amending order No. 137 took effect on 1 September 2026 without touching the model clauses. The next draft amendments were published on 24 August 2026: models move into a dedicated segment, privileged access to it requires strong multi-factor authentication, and the draft adds access control to models, filtering of inputs and outputs, request quotas and — for the first time — measures for AI agents, including autonomous ones, with control over their access rights. Per the portal the consultation ran until 8 September 2026, with entry into force planned for 1 March 2027.

The financial sector moved at its own pace. In June 2026 the regulator issued its first recommendations on information security in the development and use of models. They advise building the threat model for a model-bearing system using the FSTEC methodology, keeping a human in the loop where a model runs payments automatically, applying red team testing and — particularly apt for this text — assessing a vendor by the agents, extensions and interaction interfaces it uses, as well as by whether the model takes part in a bug bounty programme. The document is advisory, but its vocabulary matches the global risk lists exactly.

There is a practical layer too. The national threat database keeps a dedicated section for vulnerabilities in software used to build model-based systems — 951 records as of the check date, including a tool protocol library flaw with the maximum score. A section on threats to model-based systems appeared, separating the developer's environment from the operator's. Domestic defensive tools exist: a model-application monitor claims 97% injection detection accuracy, and an open university red team framework supports attacks in Russian. All of these numbers are vendor claims with no external measurement behind them.

Separately there is the law on supporting the development of AI technologies, in force since 1 September 2026. It is about support and model status rather than secure development: the threshold of no fewer than a billion parameters and the notions of sovereign and national models start working on 1 March 2027, and information security appears as a principle and as a developer's duty to keep documentation for assessing the safety of use. It sets no software development requirements — those are covered by the standards and the order.

The contour's main gap is visible the moment you put it beside the earlier sections. Systems and processes are regulated; the agent as an actor with its own identity and permissions appears only in the draft amendments, and the tool supply chain is described nowhere. Until March 2027 teams close that gap with the global risk lists — which is a perfectly normal practice, as long as you say honestly where each requirement came from.

Let us gather the three surfaces and the defensive side into one picture. The horizontal axis is evidence maturity, from idea to norm. The vertical axis is the size of the risk. The positions here are the author's: a reading of the sources as of 4 September 2026, not a measurement.

No-regret bets — the ones that pay off regardless of how the next year turns out.

• •Secret scanning in pre-commit hooks and no credentials inside the agent's workspace
• •Agent tools only from an internal registry, with pinned versions and review of changes in service directories
• •Operating system level isolation plus egress denied by default
• •A separate identity per agent run and short-lived credentials instead of a shared human token
• •A static analysis and test gate on every agent pull request, with no exception for small changes
• •Model findings accepted only with a reproducible proof; automated fixes go through the same gate as human pull requests

Threshold bets are the ones you compute before adopting. Model triage of reports pays off once the queue stops being handled by people; the public figure for that calculation already exists. Automated fixing makes sense where the defect class is checked by a deterministic test. Agent identity products become cheaper than a home-grown solution once agents number in the dozens rather than the units.

What not to do. Do not switch on the agent's automatic mode where there is no isolation and no network control: the vendor itself calls the classifier a convenience rather than a guarantee. Do not merge automated security fixes around review. Do not accept findings without proof. And do not confuse compliance with security: the first is closed with documents, the second with measurement.

It is worth saying who does all this. None of the six bets above belongs to a separate security team: the tool registry and pinned versions live with the platform team, the analysis gate with the pipeline owners, per-run identity with whoever grants access, and the rule about proof with whoever accepts reports. Collapse it all into one role and you get either a bottleneck or a showcase.

What to watch before March 2027: reporting practice under the European regulation after 11 September, the appearance of signing in the tool protocol registry, the share of model-found issues that actually get fixed, the first public data on injection incident rates in operation, supervisory practice on the model clauses, and the text of the standard for development with models.

How to read this in six months

Surface → evidence class → the boundary that closes it → measurement on your own stack → revisit in six months

• —A number without a baseline is not a number: ask what it was measured against
• —A vendor claim about its own model is a product snapshot, not an industry fact
• —Absence of public frequency data is not evidence of low risk