AI is no longer limited to suggesting code. Today's engineering agents can create pull requests, execute tests, provision cloud resources, investigate production issues, and interact with internal engineering tools with little or no human intervention. As these agents become part of everyday software development, they're also becoming another privileged identity inside the enterprise.

That creates a new security challenge. Traditional security controls assume a human is behind every action. AI agents operate differently. They can invoke tools, access sensitive systems, make decisions, and execute workflows at machine speed. Without the right controls, a poorly configured or compromised agent can introduce security risks just as quickly as it delivers productivity gains.

In this session, we'll explore what changes when AI becomes part of your engineering team and how to secure these agents before giving them access to source code, CI/CD pipelines, cloud infrastructure, or production environments. We'll look at real attack scenarios—including prompt injection, excessive permissions, insecure tool execution, secret exposure, and supply chain risks—and discuss practical ways to defend against them.

The session will introduce an enterprise reference architecture built around Zero Trust principles, least-privilege access, policy enforcement, human approval workflows, and comprehensive auditability. Rather than focusing on a specific AI platform, the discussion centers on security patterns that can be applied regardless of the underlying model or tooling.

Whether you're evaluating AI coding assistants today or preparing for more autonomous engineering workflows tomorrow, you'll leave with practical guidance for building AI agents that are productive, governed, and secure.