Featured·Article·
AI Security
Adopt AI with confidence
Your developers are already running agents. We help you put the platform and the controls underneath them, without slowing the work down.
package.json+1 −0
"graphql": "^16.9.0",
+ "keyv": "^5.5.1",
"mapbox-gl": "^3.4.0",
"motion": "^12.7.3",
Malicious version of a legitimate package. Credential exfiltration on execution.
The AI Coding Spectrum
From manual coding to autonomous agents
Each level up is more autonomy, and a bigger investment in controls.
Level 4
Autonomous agent
Claude Code, Antigravity, Codex.
- Runs as
- A developer's own context
- Can reach
- Anything accessible on the system, including sessions, data
- Stopped by
- Code review and zero trust, runtime protection
Where we come in
We work alongside your team to identify your current maturity, where you're headed, and what controls to put in place first.
- Defined autonomy tiers for the use case
- Design and implementation with defined guardrails
- Acceptable gates preventing destructive actions
Trust in AI starts with the platform
The controls that make agents safe to run are the ones a good platform already has: a blast radius you can draw, an inventory that's current, policy that's actually enforced. Get those right and you can hand agents more room without guessing at what it costs you.
cloud-estate3 unowned
- Shadow AIpersonal plans
- Agent identitiesno central inventory
- Model APIsseveral with no governance
In practice
Where to start
Nine things worth doing, roughly in the order we do them. Most of it is configuration and review process rather than new tooling.
Read the full field guide →Anatomy of an attack
Malicious instruction
The agent reads a markdown file from an untrusted source. It carries an instruction meant for the agent, not the reader.
Backdoor
The agent adds a malicious dependency, in a commit that reads like ordinary housekeeping.
Pipeline runs the malware
The malicious package gets built. Nothing in the pipeline treats agent-authored changes as untrusted input.
Exfiltration
The package exfiltrates environment variables. The build completes as expected.
Govern
Map the AI tools in use and keep governance light
Audit which AI tools developers actually use, including unsanctioned ones, and keep onboarding light — a three-month approval process guarantees shadow AI.
Require human-in-the-loop for high-risk actions
Agentic tools must ask for explicit confirmation before shell commands, network requests, deployments, or file writes outside the project directory.
Tier AI autonomy based on risk
Tier permissions by what the agent can touch and what it can do, then enforce that with per-repo configuration and CI checks.
Contain
Isolate agent execution environments
Run agents in isolated, ephemeral containers destroyed after use, and don't mount sensitive paths into the working directory at all.
Scope credentials to minimum viable access
Agent environments get short-lived, read-only-by-default credentials issued through workload identity or impersonation, with no long-lived keys and no production access.
Configure agent tool boundaries explicitly
Define permitted commands through explicit allowlists, and review those configuration files as code — everyone who clones the repo inherits them.
Operate
Gate AI-generated code through existing review processes
Agent-generated code is untrusted input, so it passes the same peer review, static analysis, and security scanning as anything a human wrote.
Monitor agent activity and extend incident response
You can't observe agent reasoning in third-party tools, so monitor unusual git activity and sandbox egress, and revert before reviewing the diff.
Build a security culture that embraces AI
Security teams should be experimenting with these tools themselves — it's the only way to talk credibly with the engineers using them.
Knowledge
View all our contentWe write it all down
Articles, podcast episodes, and talks on AI and platform security.