Only 24% of organizations that use AI tools for software development conduct a comprehensive evaluation of AI-generated code across security, IP, license, and quality. The other 76% are merging at the velocity AI agents produce — without full visibility into what they are shipping. This is not a tooling problem. It is an onboarding problem.
What Expands When You Add an AI Coding Agent
A 2026 Darktrace survey of 1,500 cybersecurity professionals found that 92% are concerned about AI agents operating with broad permissions across enterprise systems. The concern is specific: agents that access credentials, call external APIs, and write to the filesystem expose exactly those resources if misconfigured or compromised. Three attack surface vectors open the moment an AI coding agent is active:
Secret and credential leakage. AI agents generating code frequently reference API keys, tokens, and environment variables inline — often by reading .env files or configuration pulled into context. Without a dedicated secrets scanner in the PR pipeline, those values reach version control — and from there, potentially public repositories or log aggregation systems.
Hallucinated or stale dependencies. AI models suggest package names drawn from training data that may be outdated, deprecated, or entirely fabricated. Each unverified suggestion is a potential supply chain entry point that bypasses the review signal your team is trained to catch.
Unconstrained tool access. Agents configured to read files, execute commands, or call external APIs operate with the permissions of the user who provisioned them. If scope is not bounded at onboarding, the agent's blast radius equals the user's blast radius.
The same Black Duck survey of 540 software security leaders found that while 76% check AI-generated code for security risks, fewer than one in four evaluate all four dimensions — security, IP, license, and quality — together. The attack surface is expanding faster than the review process keeping pace with it.
A Five-Step Onboarding Checklist
Five controls close the highest-priority exposures before the agent writes its first production commit:
Declare scope in writing. Define which directories, branches, and external services the agent may touch. Document this in your team runbook — not only in the tool's settings. Settings drift; documentation is auditable.
Audit credential access before activation. Map every secret the agent can reach — service tokens, SSH keys, cloud credentials. Rotate anything that existed before the agent was provisioned, then configure minimum-privilege access from day one. An agent does not need write access to infrastructure to write application code.
Set merge gate conditions for AI-authored PRs. Require automated scanning — at minimum for secrets and vulnerable dependencies — on every pull request the agent opens. Manual review alone does not scale to the PR volume AI agents produce. Treat that velocity as a forcing function to invest in automated gates, not as a reason to lighten review standards.
Enable dependency pinning and lock-file verification. Force the agent's environment to consume exact versions from a verified lock file. Flag any PR that modifies a package manifest without a corresponding lock-file update as an elevated-risk event requiring additional review.
Log agent actions from day one. File reads, API calls, and generated diffs should flow to an immutable audit log. Without it, you cannot reconstruct what happened when something goes wrong — and incident response without a log is guesswork at the moment when guesswork is most expensive.
Governance After Day One
Onboarding is a one-time event; the attack surface is not. As an agent learns your codebase and team patterns, output volume increases — and so does the frequency of edge cases no checklist anticipated. A 2025 peer-reviewed study, "Broken by Default: A Formal Verification Study of Security Vulnerabilities in AI-Generated Code" (arXiv), identified exploitable vulnerabilities across AI-generated code in security-sensitive domains, with formal verification surfacing flaws that standard code review missed entirely. The code patterns that survive human review can fail under rigorous automated analysis.
The same Darktrace survey found that 61% of security leaders cite sensitive data exposure as their primary AI concern — not a one-time breach, but persistent misconfiguration that goes undetected for months. Quarterly permission reviews are the practical answer to a concern that is fundamentally about drift, not about the moment of deployment.
Treat agent permissions as a quarterly review item. Scope that was reasonable when one developer used the agent becomes a liability when the same configuration is copied across a team. Build a lightweight cadence: who provisioned the agent, what scope it holds, what it has generated, and whether any of that output reached production without remediation. That four-question review, run every quarter, closes most of the governance gap that accumulates between onboarding and the first incident.
Re-entry.ai scores every AI-authored pull request against your governance policy before it merges — flagging credential exposure, vulnerable dependency introductions, and code patterns that fall outside defined thresholds. If you are onboarding AI coding agents and need a governance layer that runs without adding manual overhead to your review process, see what re-entry.ai monitors at re-entry.ai.