Agentic Development Security: How to Secure Code Your Agents Write | Blog | Endor Labs

What it is

A conceptual guide from Endor Labs defining agentic development security — securing the build process when AI coding agents generate, select, and ship code autonomously — and distinguishing it from agentic AI security (protecting shipped agent-based products in production). The term is attributed to Forrester analyst Janet Worthington's April 2026 report "Agentic Development Security: Why AppSec Needs A New Operating Model." The summary already carries the headline metrics; what it lacks is the organizing framework and the mitigation posture below.

How it works

The page's usable contribution is a three-bucket risk model by control point:

flowchart TD
    U[What agents USE] --> A[Untrusted tools / MCP servers]
    D[What agents DO] --> B[Prompt injection & excessive agency]
    G[What agents GENERATE] --> C[Insecure code + hallucinated/malicious deps]

The core argument: when agents merge code faster than humans can read it, after-the-fact review cannot keep pace, so you must "trust the process, not the final file." Notably, rule-based SAST catches many generated flaws (missing input validation, injection, hard-coded secrets) but misses architectural design flaws — e.g. reusing one secret across services, skipping audit logs — because they don't map to a single rule.

Preconditions / Affected

Matters wherever agents autonomously resolve/install dependencies or connect to MCP servers. Additional data points beyond the summary:

• Stack Overflow 2025 (49,000+ respondents): 84% using or planning to use AI dev tools.
• Faros AI 2026 telemetry (correlation, not causation): 31.3% increase in PRs merged without any review.
• Aikido 2026 (self-reported, 450 practitioners): 69% found vulnerabilities from AI-generated code; 1 in 5 had a serious incident linked to it.
• Package hallucination is persistent: 43% of hallucinated names reappear on every run (easy squatting targets); one spread through 237 repos via AI-generated agent skills.
• 10,000+ MCP servers appeared in ~a year, many built by individuals.

What to do

The page states, not prescribes in detail:

• Use tools that verify the real package, not just the manifest name — "manifest-only tools miss this because they trust the name in the file."
• Treat every MCP input and output as untrusted, and keep an inventory of which servers your agents can reach.
• Apply SAST for pattern-level flaws, but supplement it for architectural flaws it cannot catch.

Caveats

This is a vendor guide citing Endor Labs' own research; several supporting statistics are self-reported surveys or explicitly flagged as correlation, not causation. It defines concepts and points to further reading rather than providing concrete commands or configuration.