Agentic Dev Security Starts Before the Agent Writes Its First Line

The security conversation around AI coding agents has focused on what they produce. JFrog’s argument is that the more dangerous gap is what they’re allowed to consume before they start.

What Happened

JFrog security researcher Ohad Shalev published a detailed position on Agentic Development Security (ADS) as an emerging discipline, arguing that current security tooling creates a structural blind spot: tools can tell you what an AI agent built, but most cannot tell you what the agent was authorized to consume before it began. The assets in question — AI models, MCP servers, agent skills, open-source dependencies, and development toolchain components — constitute the attack surface that precedes code generation, and governing them requires a different control layer than static analysis or post-generation scanning.

The central framing: “The unit of trust isn’t the vulnerability you detect. It’s the artifact.”

Why It Matters

Software supply chain security evolved through a similar insight about open-source dependencies: the question wasn’t just whether your code is safe, but whether the packages your code imports are safe, and whether you’re pulling them from authoritative sources. Agentic development extends this surface significantly. An agent that can install MCP servers, pull AI model weights, and invoke cloud APIs introduces supply chain exposure at each of those acquisition points — not just in the code it subsequently generates.

The gap Shalev identifies is a detection-vs-prevention distinction. Post-generation security tools — code scanners, SAST, dependency analysis — can find problems after an agent produces output. What they cannot do is prevent an agent from consuming a compromised MCP server, pulling a model with backdoor behavior, or importing a dependency from an unauthorized registry before any code is written. Prevention at that stage requires curation and governance at the artifact consumption layer.

JFrog’s proposed architecture gates agent asset access through JFrog Curation (policy-gating at request time), an AI Catalog for inventorying MCP servers and agent skills, a Package Traffic Controller that intercepts unauthorized registry access, and AppTrust for evidence-based gates before release. Previous coverage of supply chain security in agentic CI/CD contexts established why the governance problem is growing; the JFrog framework proposes a technical architecture for the prevention layer.

Source: JFrog Blog

Content created with AI assistance and reviewed for accuracy.