What Are Coding Agents? A Guide for Engineering and Security Teams

Coding agents are changing the role AI plays in software development. Instead of suggesting the next line of code, they can plan a task, edit files, run commands, read the results, and try again. That shift from suggesting to acting is what makes coding agents useful, and it’s also what makes them a security question as much as an engineering one.

Engineering leaders now have two things to get right: the quality of the code agents produce, and the actions agents can take across repositories, terminals, and connected tools. This guide explains what coding agents are, how they work, and where the risks sit, with practical guidance on permissions, pipeline controls, and what to look for in security tooling.

What Are Coding Agents?

Coding agents are AI systems that use development tools to complete multi-step software tasks. They can inspect a repository, plan changes, edit files, run tests, and revise their work based on the results. Their autonomy depends on the tools, permissions, and approval rules configured for them.

Agentic coding is the practice of using these agents to develop software. A developer might ask an agent to fix a bug, migrate an API, or add tests, then review the resulting changes.

Code completion offers suggestions that a developer accepts or rejects. Coding agents can also act in a development environment. That introduces permissions for file changes, command execution, and external tool calls beyond the ability to suggest code. Completion tools may already read substantial code context, so the important change is the authority to act.

For engineering leaders and security teams, that authority creates two connected responsibilities: verifying the code agents produce and governing their actions across repositories, terminals, connected tools, and continuous integration and continuous delivery (CI/CD) pipelines.

Understanding the agentic loop

A useful way to understand coding agents is the plan, act, observe, and adjust loop:

• Plan: Determine an approach based on the task and available codebase context.
• Act: Use a tool to read a file, write code, run a command, or query an API.
• Observe: Read the result, such as a passing test or compiler error.
• Adjust: Revise the approach and continue, or hand the task back to a person.

Consider an agent asked to fix a failing test in a payment-processing service. It reads the failure, opens the relevant files, changes the implementation, and reruns the test. If the test still fails, it can revise its approach across repeated iterations. Whether it needs approval for each action depends on its configuration.

Agentic Coding vs. Vibe Coding

The terms describe different aspects of AI-assisted development and can overlap in the same workflow.

AI researcher Andrej Karpathy coined vibe coding in a February 2025 post. His description involved accepting AI-generated code without reading the changes, feeding errors back to the model, and allowing the codebase to grow beyond his understanding. He described it in the context of throwaway weekend projects.

Agentic coding describes an AI system’s ability to act across multiple steps. It does not guarantee oversight. An agent with broad access and no review step can be used just as carelessly as an unreviewed prototype.

Scoped tasks, automated verification, and human review make agentic workflows more suitable for shared software development. The risk depends on the system’s access, the sensitivity of the task, and the controls around it.

From Autocomplete to Autonomous Agents

AI development tools support several overlapping workflows:

• Code completion: Inline suggestions that the developer accepts or rejects.
• Chat-assisted coding: Explanations and suggested changes that the developer applies manually.
• In-editor agent mode: Tool use and multi-file changes inside an integrated development environment (IDE).
• Terminal and command-line agents: Repository work through a terminal, with configurable command permissions and approvals.
• Background software engineering agents: Delegated work in a separate environment, potentially progressing from an issue to a pull request.

The interface alone does not determine autonomy. IDE agents can perform substantial tasks, while terminal agents can operate under tightly restricted permissions.

In The Pragmatic Engineer’s 2026 survey of 906 respondents across engineering and leadership roles, 55% reported regularly using AI agents. Adoption was highest among staff+ engineers. These findings describe the publication’s survey respondents, rather than all software engineers; higher adoption does not establish safer supervision.

Core Principles of Effective Agentic Coding

Define a bounded task. A goal such as adding input validation to one endpoint is easier to evaluate than an open-ended instruction to improve the codebase. Specify the expected behavior and acceptance criteria.

Provide relevant context. Give the agent the code, documentation, and project instructions it needs. Unnecessary context can increase cost and distract from the task.

Build verification into the workflow. Run tests, linters, type checks, and appropriate security checks. Compiling successfully is only one part of validation.

Set review requirements according to risk. Require independent review before sensitive changes reach a shared branch or production environment. Authentication, payments, and customer data warrant particular care.

Examples of Coding Agents and Tools

Coding tools increasingly span editors, terminals, and cloud environments. The examples below describe common entry points, rather than mutually exclusive categories.

Confirm each product’s current permissions, deployment options, and supported workflows before adopting it. Running an open-source tool locally does not necessarily mean its model inference stays local.

Claude Code led tool mentions in The Pragmatic Engineer’s early-2026 survey, while GitHub Copilot usage exceeded Claude Code usage among respondents at the largest companies. Many respondents used multiple tools. These are findings from that survey, rather than a current market-wide ranking.

Coding Agents in the Enterprise

Common use cases include:

• Modernizing legacy code: Applying framework or API migrations, with checks for behavior changes and compatibility.
• Closing test-coverage gaps: Drafting tests for existing modules, with human validation of expected behavior and test quality.
• Supporting onboarding: Helping developers explore unfamiliar codebases and identify relevant files.
• Automating maintenance: Updating dependencies, generating boilerplate, and carrying out repetitive refactors.

These tasks can benefit from automation, but their effectiveness depends on the codebase, task complexity, available context, and verification process.

Adoption also creates governance challenges. Sonar’s 2026 State of Code Developer Survey, based on fieldwork conducted in October 2025, reported that 35% of developers accessed the top 10 AI tools through personal accounts rather than work-sanctioned accounts. The finding concerns AI tools broadly, rather than autonomous coding agents alone.

Personal-account use can indicate potential shadow AI, but account ownership alone does not establish a policy violation. Organizations need visibility into which tools are approved, how accounts are managed, and what data or systems those tools can access.

What Security Risks Do Coding Agents Introduce?

Security teams need to evaluate both generated code and agent actions. These categories overlap: a compromised agent can introduce an insecure change, and a legitimate coding task can expose sensitive data along the way.

OWASP’s AI Agent and MCP Security guidance connects these risks to untrusted content, tool access, and least agency. Repository files, issues, dependency documentation, and Model Context Protocol (MCP) tool responses can contain instructions that attempt to redirect an agent.

Why passing functional tests does not establish security

Consider an agent asked to add an endpoint that returns a customer’s order history. The implementation passes tests for valid requests, but never checks whether the requester is authorized to view that customer’s data.

The feature works for the tested cases, yet remains vulnerable. Authorization tests, security-focused review, and automated checks can identify issues that ordinary functional tests may miss. No single check guarantees that a change is secure.

How Should Organizations Scope Coding Agent Permissions?

Grant access according to the task and enforce restrictions through the development environment and platform policies.

These configuration goals depend on the product’s capabilities. Least agency extends least privilege by limiting how much autonomy an agent has, as well as what it can access and for how long.

Approval requirements before merge or deployment reduce the risk of unreviewed changes reaching production. They should complement permissions, isolation, network controls, and monitoring throughout the task. An agent can still expose data or damage its environment before reaching a merge gate.

How Do You Secure Coding Agents in CI/CD Pipelines?

Protect both the environment where an agent operates and the pipeline that validates its changes. A practical baseline includes:

• Isolated execution: Use a sandbox, disposable environment, or other appropriate isolation, without production credentials or unnecessary access to developer systems.
• Scoped credentials: Limit credentials to the required task, repositories, and duration.
• Protected secrets: Avoid exposing secrets in prompts, logs, or generated code. Where credentials are necessary, use managed delivery and narrowly scoped access.
• Automated security checks: Apply static analysis, dependency checks, secret scanning, and relevant security tests to agent-authored changes.
• Independent merge and deployment controls: Enforce required checks and branch protections outside the agent’s control. Prevent agents from approving their own changes or bypassing required review.
• Attributable logs: Record the initiating user, agent identity, tool activity, code changes, and approval decisions where supported.

GitHub provides one product-specific example. Its Copilot cloud-agent documentation describes CodeQL analysis, dependency checks, secret scanning, and session logs. These capabilities are not universal across coding agents; verify what each tool provides and what additional controls your environment requires.

For the broader development process, NIST’s Secure Software Development Framework (SSDF) provides practices for reducing software vulnerabilities. It is guidance applicable to this workflow, rather than a certification specific to coding agents.

What to Evaluate in Coding Agent Security Tooling

Scanning generated code leaves agent-action risks unaddressed. Evaluate how a solution handles both, and ask vendors to demonstrate its capabilities in your environment.

• Coverage: Which agents, repositories, identities, terminals, and MCP connections can it observe?
• Enforcement: Does it detect risky activity, block actions, or both? At what point does enforcement occur?
• Policy and investigation: Can teams define policies and reconstruct an agent’s activity from reliable records?
• Developer experience: What setup, approvals, and workflow changes does it require?
• Integration depth: Which development platforms and workflows are supported, with what permissions and limitations?

For GitHub, GitLab, and Azure DevOps, verify the integration method, permissions required, supported pull-request or merge-request workflows, enforcement points, and known limitations. Test the relevant scenarios rather than relying on a platform logo.

For Zenity’s approach to governing agents and their actions, explore the Zenity platform.

Best Practices for Adopting Coding Agents

Start with a bounded pilot in lower-risk repositories. Define approved tools, access rules, review requirements, and success criteria before expanding. Measure the quality of accepted changes, review effort, rework, and security findings alongside delivery speed.

OWASP’s Top 10 for Agentic Applications, published on December 9, 2025, emphasizes least agency and identifies risks involving tool misuse, identity and privilege abuse, agentic supply chains, and unexpected code execution. Use that guidance to inform threat modeling and controls as agent capabilities expand.

Securing coding agents means controlling what they can access, verifying what they produce, and recording what they do. AI Security Posture Management (AISPM) can help teams assess agent configurations, permissions, and integrations as part of that broader approach.

Download the eBook on securing coding agents for a deeper look at threat models and governance, or connect with the team at Zenity to discuss your environment.

FAQs About Coding Agents

What are coding agents?

Coding agents are AI systems that use development tools to complete multi-step software tasks. They can inspect repositories, plan changes, edit files, run tests, and revise their work. Their autonomy depends on their tools, permissions, and approval rules.

How does agentic coding differ from vibe coding?

Agentic coding describes an AI system acting across multiple development steps. Vibe coding, in Karpathy’s original description, involves accepting AI-generated changes with little inspection or understanding. The two can overlap; agentic coding does not inherently include safe review practices.

What is the agentic loop?

The agentic loop is a way to describe how an agent plans, takes an action, observes the result, and adjusts its approach. It can repeat this process until it completes the task, encounters a limit, or hands work back to a person.

What are examples of coding agents?

Examples include agent capabilities in GitHub Copilot, Cursor, and Devin Desktop (previously Windsurf); terminal tools such as Claude Code and OpenAI Codex CLI; and platforms such as Devin and Replit Agent. Capabilities and deployment options vary by product.

What security risks do coding agents introduce?

Their code can contain vulnerabilities or exposed secrets. Their actions can also create risk through prompt injection, unsafe commands, excessive access, or external data transfer. Effective controls address both the output and the execution environment.

How can coding agents introduce vulnerabilities into production code?

An agent can produce a change that meets functional requirements while missing a security requirement, such as checking authorization. Security tests, review, and automated analysis can help identify these issues before release.

How should organizations scope coding agent permissions?

Grant only the repositories, files, commands, credentials, network destinations, and connected tools required for the task. Limit autonomy and access duration, and separate implementation permissions from approval authority.

How do you secure coding agents in CI/CD pipelines?

Combine isolated execution, scoped credentials, protected secrets, security checks, and attributable logs. Enforce branch protections and required approvals independently of the agent, and prevent agents from approving their own changes.

How can organizations balance productivity with security when using coding agents?

A practical approach is a gated rollout: begin with approved tools and lower-risk repositories, measure outcomes, and expand access as verification and governance mature. Review effort, rework, and security findings should be measured alongside speed.