AWS Security Framework for AI Coding Agents

AI coding agents offer significant productivity gains but introduce risks by optimizing for task completion at machine speed without inherent understanding of organizational risk. They can disclose secrets, open unauthorized pull requests, invoke tools without consent, and potentially lead to inadvertent data disclosure or overly permissive configurations.

Key risks include prompt and context injection (addressed by treating non-developer input as untrusted and separating agent orchestration), inadvertent data disclosure (mitigated by security requirements in steering documents and policy-as-code scanning), and uncontrolled changes reaching production (handled by branch protection rules and pre-commit hooks).

Supply chain risks, such as recommending deprecated packages or referencing vulnerable versions, are treated using Software Composition Analysis (SCA) tools and scoped registries. Uncontrolled external access through tools and APIs is managed by scoping integrations to least-privilege resources and enforcing authentication or authorization.

Hallucinations and incorrect code are addressed by layering deterministic verification (SAST, unit tests) with non-deterministic review. Scope creep, where agents make unrequested changes, is managed through reviewed specification documents that define required modifications and prevent regressions.

The proposed framework organizes controls into two pillars: author-time controls that shape what agents produce in the IDE, and build-time controls that verify what reaches production. This layered approach aims to reduce the volume and severity of issues before they reach human reviewers.

The framework distinguishes between deterministic mitigations (e.g., linters, SAST) that apply rules consistently, and non-deterministic mitigations (e.g., LLM-as-judge review, specification compliance checks) that use model judgment for context-aware evaluation. Human review serves as a final layer for risk-based decisions.