Tag
#coding-agents
7 posts
-
Slopsquatting when no human types the name: what changes for package policy once agents choose and install dependencies
Most hallucinated package names are not typos, and many repeat, so typo checks miss them. When an agent installs on its own, check existence, age and known-bad status before the install runs.
-
Two-thirds of AI users at work use personal accounts: moving coding agents to managed tenancy without a ban
DBIR 2026, via CRI, says 67% of AI users reach AI through non-corporate accounts on work devices. For coding agents that means no org policy on tools that run commands. Make the managed path easier, then enforce it on the device.
-
Before you approve coding agents org-wide: a seven-condition rollout gate for security leaders
Approve an org-wide coding-agent rollout when seven verifiable conditions hold - inventory, managed settings, a deliberate default mode, an artifact policy, egress limits, a decision log and a tested runbook. Most take days, not months.
-
Thirty minutes with the board: briefing directors on AI coding agents without fear-selling or false comfort
Directors give CISOs about 30 minutes and want better AI-risk reporting. Brief them on coding agents with four slides - one exposure number, one incident pattern, one control decision, one ask - each built from a sourced figure.
-
When an agent causes the loss and there's no attacker: the cyber-insurance trigger gap and what to ask your broker at renewal
Cyber policies usually respond to attacks and breaches. An authorised agent that deletes data or sends it to the wrong place may fit neither. Ask your broker, in writing, which clause would respond.
-
Agent-governance maturity model: five observable stages from 'anything installs' to 'enforced, logged, tested'
A five-stage model for AI coding-agent governance across six dimensions, where every stage is defined by evidence an auditor can inspect. Your stage is your weakest dimension, which makes it hard to game.
-
The agent decision log: what auditors, insurers and incident responders will ask your coding agents to prove
After an agent incident, everyone asks what was installed or fetched, under which policy, and who approved it. A minimum log schema, mapped to hook and telemetry fields, lets you answer with a query.
