Coding agents are already committing code, opening pull requests, and pushing features into production across modern development workflows. AI coding tools promise velocity, but introduce a repeatable class of security failures that evade traditional detection. This talk examines the systemic risks quietly propagating across codebases and draws on findings from multiple studies, including original research conducted at DryRun Security using real development workflows. Across this body of work, consistent failure patterns emerge regardless of model, framework, or application design, revealing structural weaknesses rather than isolated mistakes.

These failures stem from how coding agents construct software. They optimize for functional correctness along the happy path and lack a coherent understanding of how security controls must persist and evolve across the lifecycle of an application. Protections applied early are not reliably enforced as new features are introduced, and security assumptions erode across successive modifications. This talk distills the practical principles leading AI-driven engineering teams are using to close these gaps, with an emphasis on verification models and practices.