Artificial intelligence is transforming software development, shifting the roles of developers from writing code themselves to directing autonomous agents that can build, test and deploy applications.
But while coding agents promise greater productivity, they also introduce new security challenges around permissions, accountability and application architecture.
During a recent SC Media webcast, Mike Shema, host of Application Security Weekly, and Damian Tommasino, AI Forward-Deployed CTO at Snyk, discussed the transition from the traditional, human-driven software development lifecycle (SDLC) to the AI-driven agentic development lifecycle (ADLC).
Their central message: AI agents can perform more software-development tasks, but humans remain responsible for determining what should be built, how it should behave and whether the results are trustworthy.
From writing code to orchestrating agents
Traditional development processes depend on human participation throughout each stage, including planning, coding, testing and deployment. ADLC introduces coding agents as active participants capable of handling many formerly human-exclusive tasks.
As an example of today's AI-assisted coding, developers might specify requirements in natural language, establish constraints and evaluate the resulting software rather than manually implementing every feature. However, Tommasino emphasized that the SDLC-ADLC transition does not eliminate developers.
"The role of the developer is shifting and, to some degree, evolving to just interface with the coding agent in a very different way than it has in the past," he explained.
Human expertise becomes particularly important when making architectural decisions. Flawed assumptions by an AI agent that lacks context or experience can introduce authorization vulnerabilities, insecure dependencies and business-logic weaknesses.
Developers must also balance faster delivery against the possibility of introducing defects that overwhelm existing security backlogs.
Building security into the agentic lifecycle
ADLC requires security controls that are designed specifically for autonomous coding agents. Organizations must establish permissions governing which files agents can access, which commands they can execute and whether they can modify repositories without human approval.
These restrictions should reflect the agent's responsibilities. They should not automatically inherit every permission available to the agent's human operator.
"Human judgment hasn't gone anywhere," said Tommasino, who recommended bringing threat modeling into application design before coding begins. "In fact, it's actually even more important now that we're orchestrating things as opposed to just writing the code itself."
Organizations can also incorporate threat-modeling instructions into agent workflows, combining deterministic vulnerability scanners with AI-based analysis to identify business-logic and authorization weaknesses.
Continuous evaluation replaces periodic assurance
As agents accelerate development, security assessment must become more continuous. Tommasino advocated combining static analysis, dynamic application security testing, API testing and AI-assisted penetration testing according to application risk.
These complementary approaches can help teams validate exploitability, prioritize meaningful vulnerabilities and avoid overwhelming developers with low-value findings.
However, faster vulnerability discovery does not automatically produce faster remediation.
"Coding agents help, but they are not a silver bullet to solving right the entirety of the backlog in a very short period of time," Tommasino cautioned.
Humans remain accountable
The transition to ADLC changes how software gets produced, not who is ultimately responsible for its security.
Developers become orchestrators, directing agents while retaining authority over architecture, risk decisions and production readiness.
Organizations that combine agent-specific guardrails, continuous security evaluation and meaningful human oversight can benefit from autonomous development without surrendering control over what reaches production.
