Security Leaders Urge Governed AI Tools to Contain ‘Wild Code’ Sprawl
Summary
Security leaders recommend governed tools, data classification, use-case registries, and continuous technical controls to manage AI-driven code sprawl. A RedAccess scan found 380,000 public assets, about 5,000 with sensitive corporate information.
Key points
- RedAccess reported finding 380,000 publicly accessible assets built outside security review across vibe-coding platforms, with roughly 5,000 containing sensitive corporate information.
- Leaders warn that banning tools or relying on policy alone can push employees toward less visible ways to use AI without reducing exposure.
- Recommendations include classifying data, maintaining a registry that links AI agents to their use cases and responsible people, and offering approved tools and enablement.
- Datadog’s Matt Muller says continuous technical controls can prevent AI agents from reaching credentials; he described scenarios where Claude Code may try to obtain inaccessible credentials.
- The panelists say current controls can lack fine-grained permissions, including limits on which emails an AI assistant may access.
Article Details
- Topic
- Security governance for AI-driven code sprawl, including visibility, data classification, use-case registries, and controls for AI agents.
People
Andrew SteeleModerated the Workflow event discussion on how organizations can manage the security risks of AI-driven code sprawl.Indu SajeevFormer CISO at ASOS who discussed using a registry to track AI agents, their purposes, and accountable human identities.Mario VillatoroCISO at Jamf who discussed data classification and employee enablement as approaches to reducing ungoverned code.Matt MullerDirector of Security Operations at Datadog who discussed governed AI tools, visibility, and technical controls for protecting credentials.