September 2026 Summaries

Agentic AppSec describes an application security operating model in which specialized AI agents continuously understand applications, model threats, identify and prioritize meaningful vulnerabilities, generate fixes, and independently validate outcomes across both new code and existing backlogs. It is presented as a response to AI-assisted software development increasing code volume faster than traditional human-led security teams can triage and remediate issues, particularly complex authorization and business-logic flaws that pattern-based scanners may miss. The approach relies on a shared application-context model, tightly bounded agent tasks, and independent deterministic scanning tools to validate findings and fixes rather than allowing AI systems to assess their own work. It differs from agentic AI security, which focuses on protecting AI agents themselves from threats such as prompt injection, excessive permissions, and tool misuse; organizations using AI at scale may need both disciplines. Under this model, developers increasingly review agent-generated changes, AppSec leaders design and oversee the program rather than manage individual queues, and human accountability remains supported by auditable records. Snyk positions its Evo Agentic AppSec platform as an implementation that combines security agents, historical fix data, risk analysis, and deterministic verification within developers’ existing workflows.

Snyk has made its Govern Agent Behavior capability generally available within Evo Agentic Development Security, beginning with MCP Governance, which lets security and platform teams discover, approve, monitor, log, or block the Model Context Protocol servers used by AI coding agents at runtime. MCP servers enable agents such as Claude Code, Cursor, Codex, and GitHub Copilot to access external tools, repositories, databases, cloud infrastructure, and internal APIs, but their dynamic installation and execution can create supply-chain risks that traditional application security processes may not detect. Snyk reports that scans of nearly 10,000 developer environments identified 4,524 unique active MCP servers, with more than half of developers connected to production systems and one in 12 developers using an MCP server with a confirmed high- or critical-severity issue. MCP Governance uses centrally defined approval policies and lightweight endpoint hooks to enforce decisions locally without requiring a proxy, infrastructure changes, or agent workflow modifications. The company describes the release as an initial step toward broader agent behavior controls, including restrictions on destructive actions, policy sources from repositories or Confluence, risk-based enforcement, sensitive-data protections, prompt-injection defenses, secret-exposure controls, and governance for agent skills.

Security vulnerability backlogs have traditionally been treated as manageable technical debt because organizations assumed most lower-severity findings would never be exploited, but the text argues that faster AI-assisted code production, reduced ability to consult code authors, and automated attacker reconnaissance have weakened that assumption. It contends that accepted low-severity issues can be combined into serious attack paths, making backlogs an attacker-visible surface rather than merely a prioritized queue. Better prioritization alone cannot reduce a backlog when new findings outpace remediation, so organizations should measure actual inflow and closure rates, reassess old risk acceptances, track the proportion of AI-authored code, and examine whether proposed security fixes are actually merged. The proposed approach emphasizes preventing vulnerabilities during development, automating remediation where possible, and validating fixes reliably so that remediation exceeds new vulnerability creation and the backlog can shrink.

Snyk has announced the Evo MCP server, a remote Model Context Protocol service that lets users query and manage their organization’s AI asset inventory, risks, policies, and violations directly through compatible AI assistants such as Cursor and Claude Code. The service provides visibility into models, agents, MCP servers, skills, repositories, and developer machines, including where assets are located, who owns them, and what policy risks they present. Users can generate reports and dashboards from conversational queries, develop policies based on their actual inventory, and group policy violations into team-specific tickets through separately configured ticketing MCP servers such as Jira or ServiceNow. Evo uses OAuth identity and existing permissions, exposes only authorized data and tools, requires client-side approval for policy changes, and supplies query schemas intended to prevent agents from requesting unavailable or unauthorized fields. Unlike Snyk’s coding-focused MCP server, which supports security scanning of code under development, Evo MCP focuses on organization-wide governance and security oversight for AI systems and assets.

AI-driven software development and cyberattacks are accelerating faster than conventional human-led validation and remediation processes, creating growing risks from automated attacks, ungoverned development agents, vulnerable AI supply chains, and production AI systems lacking adequate inventories, policies, or audit trails. The author argues that independent validation should be required across frontier-model development, software creation, and runtime operations, emphasizing that an AI system or agent that creates code, proposes changes, or operates tools should not be its own sole evaluator. Citing perspectives from Anthropic’s Dario Amodei and CrowdStrike’s George Kurtz, along with Anthropic reports on AI-assisted espionage malware and compromised AI evaluation environments, the piece contends that organizations need both development-time controls and runtime enforcement. It recommends securing AI-generated code and dependencies before deployment, governing agents and their tools, continuously testing and remediating systems using production evidence, and ensuring findings lead to operational action. The author also supports open models, shared threat intelligence, and broad access to defensive capabilities, cautioning that overly concentrated control of AI development and security could create systemic weaknesses, and promotes a Snyk and Anthropic webinar on preparing for autonomous attacks.

Preventing new vulnerabilities in agent-generated code requires layered controls across the development lifecycle rather than relying solely on prompts, which influence an agent’s behavior but do not guarantee secure output. The proposed approach places lightweight security guidance and fast deterministic scans, including dependency, secrets, malicious-code, and common vulnerability checks, within agents’ execution and task loops so issues can be found and fixed while the agent retains the original requirements. More complex semantic weaknesses such as authorization failures, IDOR, tenant-isolation problems, and business-logic flaws require broader LLM-based code review, but its variable results, higher cost, and dependence on test coverage generally place it later in the workflow with human oversight. Risks visible only in a running application, including exploit chains, workflow abuse, prompt injection, and data-exfiltration paths, require adversarial pre-production or post-release testing supported by validated proof-of-concept exploits. The piece argues that organizations can adopt these controls incrementally despite rapidly evolving agentic development practices, prioritizing tools that are quick to deploy, minimally disruptive, centrally configurable, and removable, while distinguishing prevention of new issues from remediation of existing vulnerability backlogs.