AI Coding Agents: New Enterprise Attack Surface Risks

AI coding agents are expanding the enterprise attack surface. Nathan Hamiel, senior director of research at Kudelski Security and AI track lead at Black Hat, explains that these autonomous tools access scripts, build environments, and sensitive systems. What's different is that traditional coding assistants primarily raised concerns about vulnerable code and data exposure. However, autonomous agents introduce a new security model because they can execute code, call tools, and take actions not explicitly designed by developers. Hamiel emphasizes that security teams need to focus on architecture, sandboxing, and controls to reduce the impact if an agent behaves unexpectedly. This means limiting permissions, restricting available tools, and evaluating autonomous actions before model deployment. Security teams also need to consider runtime-generated code, which static analysis might miss. The bottom line is that security leaders must ask what could go wrong when AI is added to an existing application and if the added capability justifies the increased attack surface. This is important for understanding and mitigating new risks introduced by evolving AI technologies.