The "Junior Intern" Model of AI Security

Treating AI coding agents as infallible leads to vulnerabilities. Instead, adopt a "defense-in-depth" strategy that treats the agent like a brilliant but inexperienced intern. This requires moving away from blind prompting toward a rigorous, rule-based development lifecycle.

Enforcing Stability with Small Batches

Stability is achieved by forcing agents into a strict Test-Driven Development (TDD) loop. By requiring one test per small commit, you achieve two goals:

  • Intent Clarification: The test acts as a precise specification, preventing the agent from hallucinating features or modifying tests to fit flawed code.
  • Safety Net: Small, test-covered batches allow for safe refactoring and make peer review (human or agent-based) significantly more manageable.

Context Engineering and Scoping

Avoid "context collapse" by providing agents with only the information necessary for the task at hand. Instead of a massive, monolithic system prompt, use:

  • Local Context Files: Place .gemini (or equivalent) files in specific directories to enforce local "house rules" (e.g., specific auth requirements in an /auth folder).
  • Modular Skills: Use specialized plugins that trigger instructions only when relevant, keeping the agent's focus tight and reducing token consumption.

Hardened Execution and Verification

Standard Docker containers are insufficient for running untrusted AI-generated code because they share the host kernel. Use sandboxed execution layers like gVisor, which intercept system calls to prevent container escapes.

Beyond execution, verify agent output using a multi-layered approach:

  • Deterministic Analysis: Continue using traditional SAST (Static Application Security Testing) and SCA (Software Composition Analysis) tools in your CI pipeline. These are faster and more reliable than asking an agent to scan its own dependencies.
  • Adversarial Emulation: Use agents to perform "red teaming" on your architecture. This helps identify business logic flaws and authorization bypasses that line-by-line analysis tools often miss.
  • Principle of Least Privilege: Apply granular OAuth scopes to agent environments and require manual human confirmation for sensitive terminal commands.