Trace a change backward from production. The commit, the review, the tests, the dependency it pulled in, the prompt that started it. A person used to sit at every step in that chain. Now they only sit at one thanks to the agentic development lifecycle (ADLC).
What is the agentic development lifecycle?
The agentic development lifecycle is the process by which AI agents plan, build, modify, test, and ship software by working with tools, codebases, application programming interfaces (APIs), and development environments. They act across the toolset instead of just suggesting code. To secure the ADLC, you place controls at each of those steps. That keeps the code agents produce safe before it reaches production, without slowing the agents down.
This is a real shift from autocomplete. An agent does not suggest a line and wait. It reads the repo, edits many files, installs packages, runs tests, and opens a pull request while you watch.
The adoption numbers explain the urgency. 84% of respondents to the 2025 Stack Overflow Developer Survey use or plan to use AI tools in their development process, up from 76% the year before. Jellyfish, analyzing 20 million pull requests across 200,000 engineers, found 64% of companies now generate a majority of their code with AI assistance. Fully autonomous agent activity, where an agent opens the pull request start to finish, stays low across that dataset and grows at an exponential rate.
That last number is the one to plan around. For engineering leaders, the goal is not to slow any of this down. It is to keep agent speed while making sure what ships is safe, which means controls that run at agent speed rather than gates that stall it.
Agentic development vs. AI-assisted coding
The difference is who's driving. An AI assistant suggests code, and a human accepts or rejects it. An agent takes action across tools, repos, and the pipeline, then presents finished work.
That difference changes the risk model. When a human writes every line, review scales with people. When an agent opens dozens of pull requests a day, the old one-reviewer-per-change ratio breaks.
Where the agentic development lifecycle creates new security risk
Agent speed multiplies familiar security problems and adds a few new ones. The core issue isn't a single bad line of code. It's volume plus autonomy outrunning the review that used to catch mistakes.
Insecure code, by dfefault
Agents learn from public code, so they repeat the insecure patterns in it. That includes missing input validation, injection, broken authentication, and hardcoded secrets. The benchmarks back this up.
On the BaxBench benchmark, 62% of the solutions generated even by the best model are either incorrect or insecure. In one 2026 benchmark, 61% of solutions from SWE-Agent with Claude 4 Sonnet were functionally correct, but only 10.5% were secure, so most correct solutions still had security problems.
A harder problem is the design flaw. That's a security weakness in how the code is structured, not a single risky function. Picture an agent that adds a working feature but routes it around your existing permission checks.
Endor Labs research on architectural design flaws found these often pass static analysis, because the code looks correct line by line. For a full list of what goes wrong, see the Endor Labs breakdown of common AI code vulnerabilities.
Hallucinated and unvetted dependencies
Agents pull in packages and tools on their own, and they don't always pick safe ones. A hallucinated dependency is a package an agent recommends that doesn't actually exist. Attackers can register that predicted name later and wait for installs.
Our State of Dependency Management research found that only 1 in 5 AI-recommended dependency versions are safe. It also found 49% carry known vulnerabilities, and 34% are hallucinated (they don't exist).
Agents also reach for MCP servers. An MCP (Model Context Protocol) server is a connector that gives an AI agent access to external tools and data. The same Endor Labs research found 75% of MCP servers are built by individuals, and 82% use sensitive APIs.
The blast radius is wide because of transitive dependencies, meaning the dependencies pulled in by your dependencies. One package an agent adds can quietly bring dozens more into your build.
The verification gap: review can't keep pace
When agents ship code faster than people can read it, more changes go out unchecked. Faros AI telemetry shows pull requests merged without any review, human or agentic, are up 31.3% (this is a correlation, not proven causation).
The rate of new findings climbs too. Research cited by the Cloud Security Alliance found AI-assisted developers produce commits at three to four times the rate of their peers but introduce security findings at 10x the rate. And one 470-PR analysis found security issues were up to 2.74x higher in AI-co-authored pull requests, a sign of more security issues slipping through.
For engineering leaders, this is the crux. Speed you can't verify turns into security debt you pay for later.
Why traditional AppSec checkpoints fall short
Rule-based SAST (static application security testing) and SCA (software composition analysis) tools do their job well. They catch known anti-patterns and known CVEs (Common Vulnerabilities and Exposures). They struggle with what agents actually produce, like architectural changes, design flaws, and silently swapped libraries.
Two blind spots stand out. First, phantom and transitive dependencies get missed, because scanners often look at what you declared, not everything the build resolves. Second, design flaws pass, because each file reads as correct on its own.
Manual review isn't a fix either. Reviewing every AI pull request by hand does not scale. The Endor Labs analysis of the cost of manual review shows reviewer hours climb faster than headcount ever could.
How to secure the agentic development lifecycle
Agentic development security happens at its control points, not by bolting a separate "AI review" onto the end. Standards already point this way.
The National Institute of Standards and Technology (NIST) SP 800-218A extends secure development practices to generative AI. The Cloud Security Alliance's Agentic Secure Development Lifecycle maps controls across design through operations. OWASP catalogs the risks. The steps below turn those frameworks into a control stack you can run.
Prevent insecure patterns at generation
The cheapest fix is the code an agent never writes wrong. The Endor Labs approach to securing code at the source pushes security context into the agent and the IDE (integrated development environment). That steers agents away from insecure patterns before the code exists.
Prompt design helps more than people expect. Our research on safer prompting patterns found a recursive "secure-insecure diff" prompt pattern cut security-weakness density in generated Python by 77.5%.
Review every pull request for security impact
Every agent-generated pull request needs a review that understands architecture, not just patterns. Endor Labs' AI Security Code Review handles with three agents. They act as a developer, an architect, and a security engineer on each change.
That mix catches design flaws rule-based scanners miss, like a new API endpoint added without authentication. A pattern scanner sees valid code. A reviewer that understands the app sees a missing check.
Prioritize by reachability to cut the noise
Review keeps pace only when you cut findings down to what's actually exploitable. Reachability answers a plain question: does your code actually call the vulnerable function? The Endor Labs work on reachability-based dependency analysis builds a call graph to check that.
The math is on your side here. Endor Labs data shows about 95% of vulnerabilities live in transitive dependencies, and only about 12% of a package's code is typically used. Because of that, reachability can cut the vulnerabilities that need remediation by up to 80%. Endor Labs cuts noise by up to 95% using full stack reachability.
Remediate without slowing delivery
Fixing should feel fast, not like a tax on shipping. Evidence-based remediation, safe upgrade paths, and backported patches let teams fix a CVE now and upgrade on their own timeline. Endor Labs customers see 83% fewer blocked pull requests and fix CVEs 6x faster.
The developer impact is the point. Teams get fewer interrupted pull requests, less time arguing about findings, and fixes that don't break the build.
Govern what agents produce
You can't secure activity you can't see, so inventory which agents run and what they change. Then apply one consistent policy across the tools teams already use, including Cursor, Claude Code, GitHub, and GitLab. Human code and agent code should meet the same bar.
Consistent policy also gives compliance readers a clean story that maps to NIST, CSA, and OWASP guidance.
Where to start: an agentic development lifecycle checklist
Work through these steps in order and measure as you go.
- Inventory agent usage and AI-generated code so you know which tools run and what they touch.
- Add security context at generation through system prompts and IDE guardrails.
- Put a security-aware review on every pull request, including agent-authored ones.
- Prioritize findings by reachability so the queue reflects real exploitability.
- Automate safe remediation with patches and vetted upgrade paths.
- Measure results across blocked pull requests, mean time to remediate, and noise reduction.
Pick two metrics to report each month. Blocked pull requests and mean time to remediate speak to engineering leaders, while noise reduction and coverage speak to security leaders. Numbers turn the program into something you can prove.
Frequently Asked Questions
How is agentic development different from AI-assisted coding?
AI-assisted coding suggests changes a developer approves one at a time. Agentic development lets the agent act across files and pipelines, so controls must scale to more output.
What are the main security risks of AI coding agents?
The main risks are insecure code and design flaws produced by default. They also include hallucinated dependencies pulled in automatically, plus a gap where output ships faster than review.
Can traditional DevSecOps and SAST tools secure the agentic development lifecycle?
Traditional DevSecOps (automated security checks wired into the CI/CD pipeline) and SAST tools still catch known patterns and CVEs. They miss design flaws and transitive dependencies, so pair them with security-aware review and reachability.
Does securing AI coding agents slow development down?
It doesn't have to. Reachability-based prioritization and automated remediation cut noise and blocked pull requests, so teams fix what matters while agents keep shipping.
Ship code without compromise
Agentic development is here to stay, and the teams that do well will secure the lifecycle at its control points so they keep the speed. Prevent insecure patterns at generation, review every pull request, prioritize by reachability, and remediate without stalling delivery.
See how this maps to your own code and pipeline. Book a Demo.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
