October 2026 Summaries

Security leaders are urged to move from requiring human approval at every stage of AI-driven engineering work to a “human over the loop” model, in which agents operate autonomously within carefully defined limits while people retain responsibility for standards, exceptions, and final production decisions. The approach could accelerate tasks such as vulnerability remediation by allowing agents to investigate issues, modify code, and run repeated tests in isolated environments before human reviewers assess evidence of safety and effectiveness. Strong containment remains essential, including restricted credentials, reliable audit records, stop mechanisms, and mandatory approval for consequential actions outside an agent’s scope. The argument notes that routine approval does not inherently improve security and may delay remediation, while guidance from organizations such as the UK National Cyber Security Centre and NIST supports risk-based oversight. CISOs and companies are encouraged to collaborate closely with engineering, test agentic workflows, adjust autonomy according to evidence, and invest in security teams’ ability to shape AI adoption responsibly.

StackHawk’s HawkScan plugin for Claude Code automates application security testing after an AI agent completes a feature, fix, or refactor by configuring scans, testing the running application, addressing detected vulnerabilities, and rescanning to validate fixes. Available alongside a read-only StackHawk API plugin in Anthropic’s official Claude Code plugin directory, it analyzes repository documentation to create tailored StackHawk configurations for web, REST, GraphQL, gRPC, and SOAP applications, including technology-specific policies and authentication support for tokens, form logins, cookies, OAuth2, and custom flows. When authentication is unclear, it can analyze a browser login and use seed data tools if needed. The plugin prioritizes findings, can account for accepted risks or likely noise, and includes safeguards such as limiting scans and remediation cycles while providing progress updates and allowing users to stop it. Git hooks, commit and branch tagging, and StackHawk Attack Surface Management integration improve traceability, while the API plugin enables security-posture reporting, scan comparisons, filtering, and triage visibility without allowing changes to triage decisions. Use requires a StackHawk account, API key, and Hawk CLI or Docker version 6.0 or later.