{"slug": "agentic-code-security-what-autonomous-ai-gets-wrong", "title": "Agentic Code Security: What Autonomous AI Gets Wrong", "summary": "BrassCoders finds that autonomous coding agents, such as Claude Code and SWE-agents, bypass human code review, allowing security vulnerabilities like hardcoded credentials to go undetected. The company's research shows AI-generated code produces no generation-time security warnings, and benchmarks like SWE-bench measure functional correctness, not security. BrassCoders scans agentic code identically to human-written code, but the compressed review loop means findings may not be triaged before deployment.", "body_md": "Autonomous coding agents don't wait for a code review. They open the file, write the patch, and commit. The review loop that would catch a hardcoded credential or an unsafe deserialization call is either compressed to seconds or gone entirely. The code still runs the same scanners. The findings are the same. The person who'd normally catch them isn't there.\n\nBrassCoders scans the file on disk. It doesn't know whether Claude Code wrote it, an automated SWE-agent wrote it, or a tired engineer wrote it at midnight. The 12 scanners run regardless. What's changed with agentic workflows isn't what the patterns are — it's how long they survive before someone sees them.\n\nBrassCoders treats agentic code exactly the same as human-written code: the file lands on disk, the scanners run, and the findings go into the YAML output for your AI assistant to triage. \"Agentic\" describes the generation path, not the security properties of the result.\n\nThe term covers a wide range of workflows. Claude Code running locally with a human in the loop is one end. A CI-triggered SWE-agent that reads a GitHub issue, generates a fix, and opens a PR without any human prompt is the other. OpenHands (arXiv:2407.16741, accepted at ICLR 2025) is the open-source multi-agent framework that sits somewhere in the middle — it chains planning, coding, and testing agents together. What these workflows share is a shorter path from \"agent produces code\" to \"code runs somewhere.\" The human review step shrinks or disappears.\n\nThat's the security problem. Not that agents write bad code by nature. The problem is that the review loop that would catch pattern-detectable issues before they merge may not exist.\n\nBrassCoders was built to surface pattern-detectable findings for AI assistant workflows where a human reviews the AI's suggestion before accepting it — but agentic pipelines that commit directly to a branch eliminate that human step entirely.\n\nEvery experienced team has an informal security review layer buried in its code-review culture. Someone spots the `md5()`\n\ncall. Someone asks why that API key is in the config file. Someone flags the SQL string concatenation. The review comment might be quick — two sentences — but it happens. That human-in-the-loop step is the triage layer. An agentic workflow that commits directly skips it.\n\nThe N=15 corpus published in the BrassCoders research index (Category 12 at [/research/agentic-ai-code-security/](https://coppersun.dev/research/agentic-ai-code-security/)) documents a consistent result: AI-generated code produces zero generation-time security warnings from the agents themselves. The agents don't flag their own B303 findings or their own hardcoded credentials. They produce the code, and that's where their job ends. Static analysis is a separate pass, and in an agentic pipeline, that pass needs to be explicit — no one else will do it.\n\nBrassCoders fills a gap that SWE-bench doesn't address: resolution rate — whether agent-produced code passes existing tests — says nothing about whether that code introduces security vulnerabilities. Yang et al. (2024, arXiv:2310.06770) defined the benchmark task precisely, and security was never part of it.\n\nResolution rate measures test-passing behavior. It says nothing about security properties.\n\nA patch can pass every test in the suite and still introduce a taint path from user input to a shell call. It can pass every test and introduce a credential in a config value that the test suite never checks. SWE-bench's design is correct for what it measures. It's measuring the wrong thing for security purposes.\n\nThis isn't a criticism of SWE-bench — benchmarks measure what they measure. It's a description of a gap. When you evaluate an agent for production use based on its SWE-bench resolution rate, you're evaluating its ability to write functionally correct code. Security is a separate dimension that the benchmark doesn't capture. BrassCoders fills that gap by scanning the agent's output the same way it scans any other code.\n\nOWASP's Agentic AI Threats and Mitigations (2025, genai.owasp.org) documents three categories of agentic risk most relevant to code generation: excessive agency, task-completion bias, and cascading tool-call failures. BrassCoders addresses the output side of this surface — what the agent produced — while OWASP's guidance covers the runtime permissioning layer.\n\n**Excessive agency** — an agent with write access to a repository, broad tool-call permissions, and no human checkpoint can do more damage per bad decision than an agent operating with tighter scope. The damage radius scales with the permissions granted. An agent that can only write to a feature branch and open a PR (not merge it) has a much smaller blast radius than one with direct commit-to-main access.\n\n**Task-completion bias** — agents are trained to complete tasks. That optimization pressure doesn't include \"stop and flag security issues you notice in the existing code.\" The agent closes the issue. Whether the surrounding code it touched had pre-existing vulnerabilities is not part of its objective function.\n\n**Cascading tool-call failures** — multi-agent systems that chain planning, generation, and testing steps can propagate bad assumptions across stages. One agent's confident-but-wrong output becomes the next agent's input. The prompt injection angle to this is covered separately in [our post on prompt injection in AI coding agents](https://coppersun.dev/blog/prompt-injection-ai-coding-agents/). The SSRF variant — where an agent's tool calls can be redirected by crafted content — is in [the SSRF post](https://coppersun.dev/blog/ssrf-ai-tool-calls/).\n\nWhat OWASP documents is a runtime and permissioning problem. What BrassCoders covers is the output problem: the code the agent produced, already on disk.\n\nBrassCoders, the scanner that catches what AI assistants structurally miss, runs after the agent writes code and before that code ships anywhere consequential. That's the slot in the agentic pipeline where static analysis belongs.\n\nThe placement matters because BrassCoders is a pattern reporter, not a triage layer. It runs 12 scanners — Bandit, Pylint, Pyre/Pysa taint analysis, Semgrep, ast-grep, detect-secrets, and six custom detectors — and emits findings as YAML. The AI assistant consuming that YAML does the context-aware triage: it reads the finding, checks the surrounding code, and decides whether the pattern is a real issue or a false positive in context. BrassCoders doesn't make that call.\n\nThis division of labor is load-bearing in agentic pipelines specifically. An agent that generates code and then evaluates its own security output would be checking its own work. Static analysis from an independent scanner runs against the file without the generation-time assumptions baked in. The scanner doesn't know the agent intended the MD5 call for a non-security purpose. It flags the pattern and hands the finding to the triage layer.\n\nFor agentic workflows, that means: add `brasscoders scan`\n\nas a CI step on agent-generated branches. The scan runs, the YAML goes into the PR, and your AI assistant has a findings list to check before the patch merges. No human review loop required for the basic security pass — the loop is a scanner run followed by AI triage.\n\nBrassCoders Paid adds an embedding-based enrichment pass through our hosted gateway that deduplicates related findings and reranks them by relevance to your project's structure. For high-volume agentic pipelines producing many PRs per day, this matters: the raw finding count can reach 1500+ on a mid-sized codebase. The enrichment pass reduces that to around 300 actionable findings based on the published case studies at [coppersun.dev/benchmarks](https://coppersun.dev/benchmarks). Same scanner output, much less noise for the triage layer to work through.\n\nThe patterns BrassCoders finds in agent-generated code are the same patterns it finds in human-generated code. Bandit flags B303 for MD5 use regardless of who wrote the `hashlib.md5()`\n\ncall. The secrets scanner flags a high-entropy string in a config value regardless of whether an agent put it there to fill a placeholder.\n\nWhat changes is the distribution. In the N=15 corpus from the research index, agentic code shows a higher rate of certain patterns: placeholder credentials written into config stubs that were meant to be replaced but weren't, error handling paths that write raw exception text to logs (a B110-adjacent pattern), and URL constructions from user-supplied input without sanitization checks. These aren't uniquely agentic bugs — they're the bugs that happen when someone (or something) writes code quickly under task-completion pressure.\n\nAgents don't review their own output. The test suite passes, the PR opens, and the B703 format string sits in the handlers directory waiting to be found by someone running a scanner or by an attacker who reads the code.\n\nBrassCoders finds it first. Install the OSS core free:\n\n```\npip install brasscoders\nbrasscoders scan /path/to/agent-output\n```\n\nThe BrassCoders Paid plan ($12/dev/month) adds the enrichment layer and is worth it for agentic pipelines where raw finding counts are high. Three machine activations per license key, cancel any time with `brasscoders portal`\n\n.", "url": "https://wpnews.pro/news/agentic-code-security-what-autonomous-ai-gets-wrong", "canonical_source": "https://dev.to/coppersundev/agentic-code-security-what-autonomous-ai-gets-wrong-2omg", "published_at": "2026-07-22 17:07:11+00:00", "updated_at": "2026-07-22 17:31:40.998703+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-research", "developer-tools"], "entities": ["BrassCoders", "Claude Code", "OpenHands", "SWE-bench", "Yang et al."], "alternates": {"html": "https://wpnews.pro/news/agentic-code-security-what-autonomous-ai-gets-wrong", "markdown": "https://wpnews.pro/news/agentic-code-security-what-autonomous-ai-gets-wrong.md", "text": "https://wpnews.pro/news/agentic-code-security-what-autonomous-ai-gets-wrong.txt", "jsonld": "https://wpnews.pro/news/agentic-code-security-what-autonomous-ai-gets-wrong.jsonld"}}