Agentic Security Engineering

How do you do security engineering when the code is being changed in real time by a swarm of coding agents? We went all in and did the same. At Synthesia we strive to move fast and be efficient. We recently released Syren, taking it from internal proof-of-concept to external release in a very short timeframe, turning a prototype into a product-grade system that meets all our quality and compliance requirements. The product was being built the way a lot of software is built now: by engineers directing coding agents. In its first couple days the main repository saw around 170 pull requests, all of them written by agents and merged by humans, noo threat model and no security review. There was, however, a very ambitious launch date set in stone. In that context the traditional approach of carefully shifting security left doesn’t work: there is no “left” to shift to when the design is changing faster than a review cycle. We had to do the security work at the same time the system was being…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town