Stage Four — Development and Implementation

This is the longest section in the framework, because it is where the greatest number of controls bind and where the documented failures cluster.

13.1 What Changes at This Stage #

The development environment became an execution surface. This is the most defensible technical claim available about agentic development, and it is supported by a consistent pattern across every significant disclosed vulnerability in this class. In two Cursor vulnerabilities published to the national vulnerability database in early August 2025, prompt injection rewrote a tool-protocol configuration file whose new entry executed before the user could reject the suggested edit, and a separate flaw bound approval to a server name rather than to configuration contents, so an attacker with repository write access could swap the command body of an already-approved entry and obtain silent execution on every subsequent launch.^19,20 In the CodeRabbit compromise disclosed in August 2025, a linter configuration file supplied in an ordinary pull request executed attacker-controlled code on the analysis host, yielding the platform’s GitHub App private key and with it read and write access to approximately one million repositories.²¹ The “Rules File Backdoor” technique published in March 2025 poisons assistant instruction files with directives concealed in zero-width joiners and bidirectional text markers, which render as blank space in review and in pull request diffs, and is now a MITRE ATLAS case study.^22,57 Claude Code vulnerabilities disclosed by external researchers in 2026 followed the same shape: untrusted project settings and tool-protocol manifests executing on directory open, and an environment variable in a malicious repository redirecting API traffic before the trust prompt appeared.⁵⁸

The generalization: .mcp.json, agent rule files, editor settings, and linter configuration are executable content. They are committed, they are rarely reviewed with the care given to source, and they are frequently excluded from code-owner requirements. Treat them as code, or better, as privileged code.

Local agent tooling is a lateral movement capability. In August 2025 the Nx build system’s npm packages were compromised for approximately four hours through a workflow injection flaw. The post-install payload scanned for locally installed AI command-line tools, three of which were named in the published analysis, and invoked them with an authorization-framing prompt instructing them to act as “an authorized penetration testing agent” and enumerate the filesystem for interesting files.^59,60 Measured impact: 1,346 public repositories created for exfiltration, 2,349 distinct secrets leaked of which more than 1,100 remained valid at analysis time, followed by a second phase in which valid tokens were used to flip private repositories public, exposing 82,901 secrets across 2,399 repositories.⁶¹

This is the first well-documented case of malware using a developer’s own AI agent as a privileged discovery tool, and it reframes what an agent installation is. It is not a productivity tool with a security footnote. It is a credentialed, filesystem-capable, network-capable process running under developer identity, and it should be inventoried, scoped, and monitored as one.

Dependency selection acquired a new failure mode. The definitive measurement of package hallucination analyzed 576,000 code samples across sixteen models and two languages, finding 19.7 percent of 2.23 million recommended packages hallucinated—205,474 unique non-existent package names.⁶² The property that converts this from an error into an attack surface is repeatability: 43 percent of hallucinated packages recurred in all ten re-queries, and 58 percent recurred more than once in ten iterations. An attacker does not need to discover an organization’s private namespace; the model supplies a public, reproducible target list, and the attacker registers the names and waits. A 2026 follow-up across five frontier models found rates compressed to between 4.6 and 6.1 percent—an order-of-magnitude narrowing of the inter-model spread, not a retirement of the threat—and identified 127 package names hallucinated identically by all five models, of which 53 remained registrable.⁶³ That follow-up is an unreviewed preprint by an independent researcher and should be cited as directional.

Version selection is a separate and arguably worse problem. A study across ten models and one thousand programming tasks found that 36.7 to 55.7 percent of tasks contained at least one known CVE in the dependency versions the model specified, that 62.8 to 74.5 percent of those CVEs were critical or high severity, and that 72.3 to 91.4 percent had been publicly disclosed before the model’s training cutoff.⁶⁴ The models had the information and selected the vulnerable version anyway. This is systemic bias across all tested models rather than isolated error, and it means that dependency version pinning cannot be delegated.

The registry ecosystem is under sustained, automated attack. The Shai-Hulud npm worm’s second wave, identified in November 2025, compromised 796 unique packages representing more than twenty million weekly downloads, moved from post-install to pre-install execution to eliminate human interaction and evade static scanners, harvested cloud workload credentials via instance metadata services, established command and control through self-hosted CI runners, and added a destructive fallback that attempted to destroy the victim’s home directory when exfiltration failed.^65,66 More than five hundred unique users had credentials exfiltrated. Registry operators responded—npm permanently revoked all classic tokens in December 2025, moving to session-based authentication with two-factor enforcement at publish and trusted publishing via OIDC—which is meaningful hardening and does not change the posture a consuming organization should take.^67,68

Review is saturated. Section 3.3 established the numbers. The practical consequence at this stage is that “a human reviews everything” is a policy that is already failing in organizations that believe they have it, and the failure is silent because the merge record looks identical either way.

13.2 Elements to Adopt #

• Agent identity distinct from human identity. Every agent operating at A2 or above requires its own principal. Not a shared bot account, not a developer’s personal access token, not a service account inherited from CI. The reasons are ordinary: attribution, revocation, scoping, review. The failure is ordinary too, and it is documented: the OWASP Non-Human Identities Top 10 leads with improper offboarding, and includes overprivileged identities, long-lived secrets, and identity reuse, all of which describe how agents are typically provisioned in practice.⁶⁹
• Ephemeral, task-scoped credentials. No standing credentials in an agent execution context. Where the toolchain supports OIDC-based credential exchange, use it; where it does not, issue short-lived tokens bound to the task. The relevant test is a demonstration rather than a policy: compromise a test agent’s context and enumerate what is obtainable and for how long it remains valid.
• Execution isolation with default-deny egress. Agents execute in non-privileged, isolated runtimes with no host filesystem or host network access, and outbound connectivity restricted to an enumerated allowlist. Package installation flows through an internal mirror treated as a production security boundary. Every permitted egress path has a named owner and a patch cadence.
• Configuration files as privileged code. Tool-protocol manifests, agent instruction and rule files, editor settings, and CI configuration require code-owner review, are covered by branch protection, and are scanned for concealed content—zero-width characters, bidirectional overrides, and other invisible-rendering techniques. Approval of a tool-protocol server binds to the configuration contents, not to the server’s name.
• Dependency governance that does not trust generation. New dependencies introduced by agent-authored change require explicit approval against a maintained allowlist. Every dependency is version-pinned with an integrity hash. Package existence, age, download history, and maintainer provenance are checked before install rather than after. Internal namespaces are reserved on public registries to close the confusion path. Given the measured version-selection bias, dependency versions in agent-authored change are resolved by the toolchain against policy, not accepted as the model specified them.⁶⁴
• Provenance emission at authorship. Agent-authored commits carry attribution in the commit record, are cryptographically signed, and link to a session record that identifies the model version, the invoking human, the tool set, and the task. The reference implementation observable in shipping platforms attributes the commit to the agent with the invoking human as co-author, signs it, and links each commit to session logs.⁷⁰ Where contributions may flow upstream, the disclosure convention that projects have converged on is a dedicated commit trailer, with the rule that agents never add Developer Certificate of Origin sign-off because only a human can certify it.⁴³
• A merge boundary that holds. The most concrete published control set for a repository-resident coding agent, and one worth adopting whatever product implements it, comprises: only users with write access may invoke the agent; the agent pushes to exactly one designated branch; the agent cannot execute version control commands directly; its output opens as a draft pull request that it cannot mark ready; it cannot approve its own pull requests, so review requirements survive; CI workflows do not execute until a human with write access approves them; network access is firewall-restricted; and hidden characters are filtered from input.⁷¹ Each of these is a separate control and each closes a specific path. The self-approval prohibition and the workflow approval requirement are the two that most directly preserve the separation of duties that DORA’s technical standards require and that SOC 2 CC8.1 assumes.^4,3
• Review triage rather than uniform review. Uniform review does not survive contact with the volume. Risk-tier the change instead: security-relevant paths, authentication and authorization code, configuration files, dependency manifests, infrastructure definitions, and public interfaces receive mandatory senior review regardless of size, while low-risk mechanical change receives lighter treatment. Automated review assists triage; it does not replace the human decision on the high-risk tier. And the practice worth borrowing from source-provenance standards is two-person review on protected branches, which is precisely what the SLSA Source Track’s highest level requires.⁷²
• Measured review integrity. An approval control with a very high approval rate and a very short median review time is not a control. Instrument approval rate, median and 95th-percentile review duration, and diff size at approval. Where those metrics degrade past a threshold, the correct response is to lower the merge rate, not to note the trend.
• Concurrency governance. Given a measured 41.7 percent cross-product conflict rate when agents from different vendors work the same repository concurrently, limit concurrent agent work streams per repository, partition agent scope by module or path, and require rebase-and-reverify rather than merge-and-hope.³²

13.3 Controls #

13.4 Evidence to Request #

• A live demonstration of credential exposure: compromise a test agent execution context and enumerate every credential obtainable and its remaining validity.
• The platform ruleset configuration showing the self-approval prohibition and the workflow approval requirement, plus the list of configured bypass actors and when each was last reviewed.
• Approval-rate and review-duration telemetry for the trailing quarter, broken out by whether the change was agent-authored.
• A random agent-authored commit traced to its session record, model version, invoking human, and reviewer.
• The dependency allowlist with its approval history, and evidence that a hallucinated or vulnerable package was actually blocked.
• The egress allowlist with owners and last-patched dates.

13.5 Failure Modes #

• Agents operating under human credentials. The most common provisioning outcome and the one that makes everything downstream unanswerable. Attribution fails, revocation is impossible without disabling a person, and access review reports a human population that is partly machine.
• Configuration excluded from review. The .github directory, the agent rule files, the tool manifests—reviewed casually or not at all, because they are not “code.” Every major disclosed vulnerability in this class went through exactly this gap.
• Self-approval available and unnoticed. Frequently a default rather than a decision. Where an agent can approve its own pull request, the separation-of-duties requirement in DORA’s technical standards, the PCI DSS requirement for review by someone other than the originating author, and the SOC 2 change-authorization criterion are all unsatisfied simultaneously, and no control reports it.
• Bypass actors accumulating. Rulesets grow exceptions. An agent added as a bypass actor to unblock a delivery deadline remains one indefinitely, and the ruleset that appears to enforce review does not enforce it for the principal generating the most change.
• Security findings outrunning triage. Where generated volume produces findings faster than they can be adjudicated, the observable response is suppression—thresholds raised, rules disabled, findings bulk-dismissed. The scale of the problem is acknowledged at the ecosystem level: the Linux Foundation announced $12.5 million in grant funding in March 2026, contributed by seven major technology and model-provider organizations and managed through Alpha-Omega and the Open Source Security Foundation, citing “an unprecedented influx of security findings, many of which are generated by automated systems” and committing funds to help maintainers with “the triage and processing of the increased AI-generated security reports they are currently receiving.”⁷³ Enterprises face the same arithmetic internally, and should measure findings-generated against findings-adjudicated as a first-class metric.
• Local agent installations outside inventory. A developer installs a capable agent, points it at a repository, and grants it credentials, entirely outside procurement and entirely outside the controls above. This is not misconduct; it is the path of least resistance, and it is closed by making the governed path easier rather than by policy.