Ethical Hacking News
As AI-assisted applications become increasingly prevalent, security teams must take proactive steps to tame wild code and ensure the security and integrity of their applications. By adopting a comprehensive approach that combines governance, education, and design, security teams can reduce the risk of security breaches and protect sensitive data.
Wild code is a major challenge for security teams in AI-assisted applications. Security teams need to define shared boundaries with IT and system owners and apply them consistently. Three principles can be used to build controls into the environment: govern before deployment, make the approved route the easiest route, and make investigation and intervention part of the design. The first principle emphasizes defining permitted data sources, actions, and access before deployment. The second principle advocates for an environment that lets employees solve real problems quickly and accessible building experiences. The third principle highlights the need to understand what a workflow did, not just what it was intended to do.
In the realm of artificial intelligence (AI), the proliferation of AI-assisted applications has become an increasingly pressing concern for security teams. As employees build and deploy these applications, the risk of wild code, where useful builds spread faster than the processes for owning, securing, and maintaining them, becomes a major challenge. This phenomenon is exacerbated by the lack of adequate governance, leading to a plethora of security risks that can compromise sensitive data, expose unauthorized access, and even enable malicious activities.
The article "What Security Teams Can Do To Tame Wild Code" sheds light on the need for a more sustainable approach to control wild code. According to the article, education, sandboxes, and AI steering committees are not enough to govern software they may never encounter or control what happens after it starts running. Instead, security teams need to define shared boundaries with IT and system owners, apply them consistently throughout the lifecycle, and update them as business needs and risks change.
The article proposes three principles to build controls into the environment employees use to create, run, and maintain their work: govern before deployment, and keep governing afterward; make the approved route the easiest route; and make investigation and intervention part of the design. These principles are designed to give teams room to build AI-assisted apps, agents, and automations while keeping security in control of how that work runs.
The first principle, "Govern before deployment, and keep governing afterward," emphasizes the importance of defining permitted data sources, actions, and access before employees connect business systems. It also stresses the need to keep those controls in place when the workflow goes live, ensuring that permissions reflect what a workflow needs to do, not everything its creator can access.
The second principle, "Make the approved route the easiest route," recognizes that employees need more than a list of restrictions. It advocates for an environment that lets them solve real problems quickly, accessible building experiences, useful connections to approved systems, and a clear route from idea to operation. This approach aims to limit risky alternatives, allowing security teams to focus deeper review on sensitive access and consequential actions.
The third principle, "Make investigation and intervention part of the design," highlights the need for security teams to understand what a workflow did, not just what it was intended to do. It emphasizes the importance of keeping ownership, execution identities, relevant actions, and changes traceable, protecting those records without capturing sensitive information in logs.
By adopting these principles, security teams can establish a governed environment that makes important security questions answerable without a separate investigation. This approach enables them to reduce reliance on employees remembering every rule and security discovering every problem after the fact.
In conclusion, taming wild code requires a comprehensive approach that combines governance, education, and design. By applying the principles outlined in the article, security teams can create a more sustainable and secure environment for AI-assisted applications, reducing the risk of security breaches and ensuring that sensitive data is protected.
Related Information:
https://www.ethicalhackingnews.com/articles/Mastering-the-Art-of-Governance-Taming-the-Wild-Code-of-AI-Assisted-Applications-ehn.shtml
https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html
Published: Tue Oct 20 16:07:22 2026 by llama3.2 3B Q4_K_M
