Book a Demo
●Insights

Coding agent security insights

Insights on AI coding agent risk, security, and the future of developer tool governance.

LatestJul 30, 20269 min read

Break Out to Finish the Task

Agentic systems are increasingly optimized to get the job done even when that means pushing past the guardrails designed to contain them.

AI SecurityAutonomous AgentsKill ChainAASB
Read article
Break Out to Finish the Task
The Claude Desktop App Governance Playbook

The Claude Desktop App Governance Playbook

May 21, 202613 min read

Claude Desktop is no longer a chat app. It hosts chat, Cowork, and a launch surface for Claude Code, with MCP support, file access, and agentic execution on every knowledge worker's machine. Here is the governance playbook for security teams running it at scale.

ClaudeClaude DesktopCowork
Novageness Brings Full Enforcement to GitHub Copilot

Novageness Brings Full Enforcement to GitHub Copilot

May 19, 20268 min read

GitHub shipped postToolUse hooks in the Copilot CLI on May 18, 2026. Novageness now governs Copilot at parity with Claude Code, Codex, and Cursor: audit, warn, approve, block on the most widely deployed AI coding agent in the enterprise.

AASBGitHub CopilotGovernance
Prompt Injection in Coding Agents: Every Attack, Every Defense

Prompt Injection in Coding Agents: Every Attack, Every Defense

Apr 29, 20269 min read

Every prompt injection vector specific to AI coding agents, with proof-of-concept patterns, detection signals, and defensive controls. Why action policy beats detection.

AI SecurityPrompt InjectionMCP
Top MCP Server Risks in Production: A Red Team Walkthrough

Top MCP Server Risks in Production: A Red Team Walkthrough

Apr 27, 202611 min read

Three MCP exploit chains end to end: tool poisoning, exfil chain, and confused deputy. Detection telemetry, controls, and AASB mapping for each.

MCPRed TeamingAI Security
Every Known MCP Attack Pattern, Mapped: A Defender's Taxonomy

Every Known MCP Attack Pattern, Mapped: A Defender's Taxonomy

Apr 20, 202610 min read

The five attack classes targeting AI coding agents through Model Context Protocol servers. Preconditions, mechanism, detection signal, and the controls that stop each one.

MCPAI SecurityGovernance
Governing Claude Across Web, Desktop, and Code: What Security Teams Need to Know

Governing Claude Across Web, Desktop, and Code: What Security Teams Need to Know

Apr 14, 20267 min read

Claude operates across web, desktop, CLI, and Cowork surfaces. Each has a different risk profile. Learn how to govern Claude usage consistently across your organization.

ClaudeClaude CodeAI Security
AASB Buyer's Guide: How to Evaluate Agent Access Security Platforms

AASB Buyer's Guide: How to Evaluate Agent Access Security Platforms

Apr 8, 20265 min read

How to evaluate Agent Access Security Broker platforms. Covers must-have capabilities, vendor questions, scoring framework, and red flags to watch for.

AASBBuyer's GuideAI Security
What is an Agent Access Security Broker (AASB)?

What is an Agent Access Security Broker (AASB)?

Apr 6, 20269 min read

An Agent Access Security Broker (AASB) governs how AI coding agents access tools, data, and infrastructure. Learn how AASBs work, why CASBs fall short, and what to evaluate.

AASBAI SecurityAI Coding Agents
Shadow AI Coding Agents: The Security Risk Your Engineering Team Isn't Talking About

Shadow AI Coding Agents: The Security Risk Your Engineering Team Isn't Talking About

Apr 5, 20265 min read

Shadow AI coding agents are running in your development environment without security approval. Learn how to detect them, assess the risk, and build governance that scales.

Shadow AIAI Coding AgentsDeveloper Tools
Securing Cursor, Codex, and Claude Code: A Comparison of AI Coding Agent Risks

Securing Cursor, Codex, and Claude Code: A Comparison of AI Coding Agent Risks

Mar 31, 20264 min read

Compare the security architectures and risk profiles of Cursor, Codex, and Claude Code. Understand what each tool accesses and how to govern them with one policy engine.

CursorCodexClaude Code
The AI Coding Agent and AASB Glossary

The AI Coding Agent and AASB Glossary

Mar 29, 202612 min read

Definitions for the new control layer between AI coding agents and your enterprise. Covers AASB, MCP, agent mode, auto-approve, prompt injection, tool poisoning, and more.

AASBAI SecurityGovernance
What Happens When an AI Coding Agent Goes Rogue: Real-World Incident Scenarios

What Happens When an AI Coding Agent Goes Rogue: Real-World Incident Scenarios

Mar 25, 20265 min read

Four realistic scenarios showing how AI coding agents can leak credentials, exfiltrate data, and compromise infrastructure. Each maps to a documented 2025 incident and a prevention path.

AI SecurityIncident ResponseThreat Scenarios
AI Coding Agent Security for Financial Services: Compliance Requirements and Controls

AI Coding Agent Security for Financial Services: Compliance Requirements and Controls

Mar 23, 20264 min read

AI coding agents in financial services create regulatory exposure under OCC, FFIEC, SEC, and NY DFS guidance. Here are the specific risks and required controls.

Financial ServicesComplianceAI Coding Agents
AASB vs. CASB: Why AI Coding Agents Need a New Security Category

AASB vs. CASB: Why AI Coding Agents Need a New Security Category

Mar 20, 20268 min read

Cloud Access Security Brokers were built for human access to SaaS. AI coding agents introduced a different problem: software that can read, write, execute, connect, and act. That shift requires a new control layer.

aasbcasbai-security
The CISO's Guide to AI Coding Agent Risk

The CISO's Guide to AI Coding Agent Risk

Mar 20, 20266 min read

A practical framework for CISOs managing AI coding agent risk. Covers the five risk categories, where existing tools fall short, and how to build a governance program.

CISOAI Coding AgentsRisk Management
The State of AI Coding Agent Risk

The State of AI Coding Agent Risk

Mar 20, 202614 min read

A comprehensive analysis of the security, compliance, and operational risks enterprises face as AI coding agents become the default developer interface — mapped to the OWASP Top 10 for Agentic Applications.

aasbowaspai-security
AWS Kiro Didn't Just Delete an Environment. It Exposed the Missing Control Plane for AI Coding Agents.

AWS Kiro Didn't Just Delete an Environment. It Exposed the Missing Control Plane for AI Coding Agents.

Mar 18, 20268 min read

A reported December 2025 AWS incident involving the Kiro AI coding agent turned a small software fix into a 13-hour outage. The strategic lesson: enterprises need a dedicated governance layer between AI coding agents and the systems they can change.

aasbai-securityincident
How Novageness AASB Addresses Key OWASP Risks for Agentic Applications

How Novageness AASB Addresses Key OWASP Risks for Agentic Applications

Mar 18, 20267 min read

AI coding agents change the security question from model usage to live access governance. Here's how Novageness's Agent Access Security Broker maps to the five highest-impact OWASP agentic risks.

aasbowaspai-security
How to Govern AI Coding Agents Without Killing Productivity

How to Govern AI Coding Agents Without Killing Productivity

Mar 16, 20267 min read

You do not need to choose between speed and control. The right governance model lets developers keep the AI coding tools that make them faster while applying discovery, posture checks, runtime controls, and approvals to the actions that create enterprise risk.

aasbgovernanceai-security
Your Team Adopted Cursor. Do You Know Which MCP Servers It Can Reach?

Your Team Adopted Cursor. Do You Know Which MCP Servers It Can Reach?

Mar 8, 20264 min read

MCP servers give AI coding agents access to databases, APIs, and infrastructure. Most security teams have no idea they exist.

mcpcursorshadow-it

Ready to govern your coding agents?

Get full visibility in under 5 minutes. No code changes, no developer disruption.