AI won’t wait for your security review.
Hey there,
This week’s issue includes one thought on keeping security review current as agents change the code, five security articles worth your time, and Podcast Corner.
SPONSORED BY ORIGIN
Codex borrowed Claude Code's staging connection to finish a task, then relaunched Claude Code with --dangerously-skip-permissions, without asking the engineer. Origin's trace followed the handoff down to the single flag that did it. If your agents can launch each other, which controls still apply?
Chris’s Corner: security review at agent speed
When did your team last review the design of the code you’re shipping today?
You wouldn’t rely on last year’s home inspection after somebody added a second floor. I think about security reviews the same way. We review a design, developers change the application, and somewhere along the way that review stops describing what we’re building. We need a better way to do this—we need security and privacy-by-design style reviews integrated into the development workflow, and we need to reach “continuous security and privacy by design.”
Agents make that gap harder to ignore. A developer can change a lot of code between two meetings on your calendar. I want security review to keep moving with that code.
Robinhood’s Vikram Ashtaputre wrote about how his team does this with Prowler, an internal system that continuously reviews services from source. Agents investigate the code and challenge each other’s findings. People decide what to fix. I love the concept of agents challenging each other’s findings. I think it’s the only path forward for secure AI development.
I like that they stopped asking the model to do everything. They moved workflow state and other predictable bookkeeping into code. The agents handle the work that needs judgment.
I’d use that division in my own review process. Let software track which commit we reviewed and whether a step finished. Ask the agent to explain how a user could get around an authorization check. I don’t need a model deciding whether it remembered to save a result.
There’s also a failure worth reading closely. The team closed a finding after Prowler couldn’t establish exploitability. A human pentest later confirmed it. The missing evidence was in another repository the system couldn’t read. We can’t outsource the entire Secure Development Lifecycle to agents. Humans must continue to own the process and validate the results.
That’s why I want every review to tell me what it couldn’t see. If you couldn’t inspect the access-enforcing gateway, say so. I need that information before I decide a finding is ready to close.
You don’t need to build Robinhood’s whole system to start. Pick one service your team changes often. Write down the security rules it must enforce, give the reviewer the code it needs, and have a developer and a security engineer work through the first results together.
Then make the next review better. Keep the findings that held up, the reasons others were wrong, and the questions you couldn’t answer. Use bugs found by developers and pentesters to check what your agent missed.
I believe we can make deep security reviews a regular part of building software. Start with one service this week. Read Security Review at the Speed of Agents for the approach that got me thinking about it.
Five Security Articles Worth Your Time
How one hacker used AI agents and a few thousand dollars to break into scores of sites. Reuters reports that one operator’s agents attempted more than 1,200 websites and broke into sites belonging to over 100 companies. NorForge’s Snorre Fagerland estimated about $50 in tokens per successful intrusion. Chris’s take: The operator’s instructions were under 100 Chinese characters. When an agent couldn’t crack a big company’s main app, it found a related control panel and got in there. I’d check your support sites and vendor-run pages, not just the flagship.
ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage. MITRE adds Direct and Indirect Prompt Injection (T1699, T1698) and AI-Enabled Exfiltration (T1700), and extends T1195.001 to coding agent config files. Chris’s take: Prompt injection has ATT&CK IDs now, so it belongs in detection and design reviews. I’d read T1700 first. The agent doesn’t need new access. It uses the tools I already gave it.
Inside a PaperCut Attacker’s AI Toolkit. Hunt.io found the operator’s exposed workbench, including an AGENTS.md describing Codex paired with a DeepSeek model and instructions for up to 25 concurrent subagents. Chris’s take: The attacker wrote an AGENTS.md, the same file I’d drop in a repo. It told the agent to assume the bug exists, switch approaches after two failures, and fan out in waves. If you ran an exposed PaperCut server this summer, I’d hunt for compromise, not just patch.
LLMs are making formal software verification feasible at a much larger scale. Anthropic and Theorem used Claude to turn OSS-Fuzz tests into formal specifications, patch bugs, and prove no-crash properties for 239 compiled fuzz-test entry points across 123 libraries, under specific runtime and input assumptions. Chris’s take: Read the limitations section. These OSS-Fuzz proofs assume single-threaded, static RISC-V/Linux binaries, a fixed memory budget, and inputs below 64 MB. They don’t establish that every build or every entry point is bug-free. I still like where this is going: Rocq-checked proofs. Writing proofs has been hard to scale. AI can take on more of that work. This will be worth watching.
Security Review at the Speed of Agents. Robinhood’s Vikram Ashtaputre describes Prowler, an internal review pipeline that runs nightly against selected production services, with code handling orchestration and agents handling judgment. Chris’s take: Read the verifier part. Each candidate gets a skeptical verifier; high-severity findings get multiple independent votes. Robinhood reports 92% root-cause confirmation in an additional agent review. That result doesn’t measure how many bugs the system missed.
Podcast Corner
I love making podcasts. Here are two recent conversations.
Application Security Podcast
Ahmad Sadeddin of Corgea joins me to discuss his team’s observations of agent-written replies to security findings. He reports that roughly 45 percent of developer comments marking findings as false positives were wrong.
 | From this episode Developers Get False Positives Wrong 45% of the Time |
AI Security Table
Izar, Matt, and I dig into OpenAI’s call for federal rules on frontier labs, an NTSB-style board for AI attacks, and who’s on the hook when an agent breaks out.
 | From this episode Nobody Is Going to Jail |
Where to find me: I’ll be at OWASP Global AppSec USA in San Francisco, Nov 5 and 6, moderating a keynote debate and recording a live podcast. Come say hello.
ONE QUESTION FOR YOU
How do you keep security reviews up to date?
Reply and tell me what triggers a fresh security review on your team, and how you decide whether an agent’s finding is ready for an engineer.
Chris
