Agentic AI Is Shipping Code. Who Owns The Risk?

Andrea Scaduto is co-founder and CEO of SecureFlag, a secure coding training platform.

Not long ago, much of the discussion in software engineering circles was about whether developers should use AI to write code. Now, the focus is on agentic AI and agents that run commands with minimal human direction.

Gartner put agentic AI at the top of its 2026 cybersecurity trends, warning that the technology is creating new attack surfaces as employees and developers adopt it, and that no-code platforms and vibe coding are speeding up the spread of unmanaged agents, unsecured code and potential compliance violations.​​

Accountability For Agent-Generated Code​

Before AI agents, development gave organizations a fairly clear path to accountability. A developer makes the change, a reviewer checks it and the service team owns what reaches production.

The chain is now more complicated when an AI agent takes a feature request and turns it into code for a developer to review. For example, a product manager provides the instructions, the agent generates the change and the developer approves it. If that change exposes customer data, who owns the decision to ship it?

The most practical answer, I’d argue, is the person who approves the merge. Agent-written code becomes the organization’s code once a developer approves it, so that approval can’t be a formality. If the person signing off can’t explain what a change does and why it’s safe, it shouldn’t be deployed.

Customers won’t accept “the AI wrote it” as an explanation, and neither will auditors or regulators. The EU’s Cyber Resilience Act makes this clear by placing responsibility on the organizations that put products on the market.​

The Security Risks Of Faster Development​

It’s certainly beneficial that teams can now produce more software faster, but they don’t automatically gain the capacity to assess it all. More output also means more changes to approve, and less time to give each one proper attention.