AI Coding Agent Security: Risks, Controls, and Evidence

Why the AI assurance model is consolidating

On October 19, 2026, the AICPA and the Artificial Intelligence Underwriting Company announced a joint assurance certification combining their SOC 2 and AIUC-1 examination processes into a single independent review of business risk related to AI systems and agents. The model produces one report through one CPA-led engagement. Several CPA firms are already delivering it, and a full launch is expected in early 2027.

The reasoning matters more than the mechanics. The AICPA’s framing is that trust between AI vendors and enterprise buyers currently gets negotiated one security questionnaire at a time, and that this report is meant to end that.

Anyone running AI coding agents already understands why. As AIUC cofounder Rajiv Dattani put it, AI agents do real work faster than anyone can check it, and because agents now hold credentials, call APIs, and act inside core systems, an AI failure is increasingly a security breach.

Questionnaires are the wrong instrument for that problem. Here is what the right one looks like.

Why coding agents break existing controls

Most security programs rest on a reliable assumption: a human wrote the code, and a human reviewed it before it merged. AI coding agents break that assumption in both directions. They read repositories, execute commands, call tools, and open pull requests, often while holding credentials that reach into CI/CD pipelines and production-adjacent systems.

An agent’s mistake does not wait in a review queue. It executes.

For security, engineering, and procurement leaders, the short version is this: most organizations are already running coding agents; the attack surface they create is now documented rather than hypothetical; and existing vendor review processes were not built to find these failures.

The 2026 incidents that settled the argument

The warning signs came early. In December 2025, Aikido Security disclosed PromptPwnd, finding that at least five Fortune 500 companies ran CI/CD configurations in which AI agents ingest untrusted repository data while holding elevated pipeline credentials.

In February 2026, that risk became a live supply chain compromise. The Clinejection vulnerability, disclosed by researcher Adnan Khan, began with a single malicious GitHub issue title and chained multiple weaknesses in the Cline AI coding tool’s release pipeline. An attacker used it to publish an unauthorized version of Cline’s npm package, which reached developer machines for roughly eight hours before removal.

In April, researcher Aonan Guan, working with Johns Hopkins researchers Zhengyu Liu and Gavin Zhong, demonstrated a cross-vendor attack class called Comment and Control. They showed that Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub’s Copilot Agent could all be hijacked through prompt injection payloads placed in pull request titles, issue bodies, and issue comments, causing the agents to leak repository and API secrets back through GitHub itself. No attacker-controlled server. No unusual outbound traffic. The exfiltration path was the collaboration platform the agent was already trusted to use.

OWASP reached the same conclusion at the ecosystem level. Its State of Agentic AI Security and Governance report (v2.01, June 2026) shifted from cataloging plausible threats to cataloging actual CVEs, vendor advisories, and breach reports across nearly every category of agentic risk.

Four control gaps to examine in any agent deployment

Credential reach. Agents routinely access environment variables, configuration files, and tokens well beyond what a given task requires. GitGuardian’s 2026 State of Secrets Sprawl report found more than 24,000 unique secrets exposed in MCP configuration files on public GitHub repositories. Scope what an agent can read with the same rigor applied to what it can change.

Trust boundaries in context. The core design flaw behind Comment and Control was that issue comments and PR titles carried the same trust level in the agent’s context window as instructions from the repository owner. Any content an agent reads, including dependencies and documentation, is a potential instruction channel.

Insecure generated code. Agents produce code that compiles and passes tests while carrying injection flaws, weak authentication logic, or vulnerable dependencies. Generated code needs to clear the same security gates as human-written code.

Containment. A CVE disclosed against Cursor allowed an attacker to poison the agent’s execution environment so that allowlisted commands delivered arbitrary payloads. Allowlisting a command is not the same as constraining what that command can do.

Why documentation review cannot find these failures

Every agent named above would have answered a questionnaire accurately. Each vendor could point to a documented permission model, a sandbox, and an injection defense. The controls existed on paper. They failed in operation.

That is the structural problem facing security and procurement teams. The evidence required is behavioral. The review process in place is documentary.

What AIUC-1 verifies

AIUC-1 is the first security, safety, and reliability standard built specifically for AI agents, developed by the Artificial Intelligence Underwriting Company with researchers from MIT, MITRE, and Stanford. It comprises 55 requirements and 145 controls across six risk pillars, and it certifies a specific AI system or product rather than the organization as a whole. A consortium of more than 250 CISOs and security leaders from Fortune 1000 companies built it.

The distinction that matters for coding agents is testing. AIUC-1 tests agents through adversarial interactions rather than policy reviews alone and covers hallucination, data-leakage, and prompt-injection scenarios. A typical evaluation covers thousands of scenarios.

It fits alongside existing programs rather than replacing them. AIUC-1 maps to frameworks including MITRE ATLAS, ISO 42001, and the EU AI Act. An organization holding both ISO 42001 and AIUC-1 can demonstrate two different things: how it manages AI risk on paper, and how its AI holds up under pressure.

The cadence also reflects how fast the technology moves. Both SOC 2 reports and AIUC-1 certifications require annual renewal, with quarterly AIUC-1 technical retesting on top. The standard itself is updated each quarter to keep pace with AI capabilities, risks, and emerging legislation.

Where Coalfire fits

Coalfire has received accreditation as an auditor for the AIUC-1 certification program, expanding an AI assurance practice that already includes ISO 42001 certification, AI security and model testing, AI threat hunting, and AI security evaluations.

Coalfire CEO Brad Little has framed the demand plainly: organizations want stronger assurance that their AI systems are governed responsibly and remain resilient against emerging threats. Dattani has noted that Coalfire’s experience in cybersecurity, independent assurance, and technical security testing helps organizations validate both the governance and technical resilience of their AI systems.

That pairing is the point. An AIUC-1 audit involves a full review of policy, operational, and technical controls across the standard’s six domains, conducted by an accredited auditor. Coalfire conducts roughly 3,000 assessments a year across more than 100 frameworks. The same team that understands an organization’s pipeline, penetration test findings, and compliance obligations can scope its agents, identify evidence gaps, and prepare it for technical testing.

Know what your agents can actually do.

A scoped AIUC-1 readiness conversation clarifies which controls apply to your agent, what evidence you already have, and what testing will require. One agent, one workflow, one hour.