How Do I Secure Code That AI Agents Write Autonomously, Or Code That Uses Agents?

Agent-Written Code Is Still Code — And It Lands In Your Repository

BrassCoders treats code from autonomous AI coding agents the same as code from human authors: it lands in the repository, the same 12 scanners run against it, and the same YAML findings file goes to the AI assistant for triage. SWE-bench is the canonical benchmark measuring how well agents close real GitHub issues; SWE-agent and OpenHands are the reference implementations of how those agents work. OWASP's agentic AI guidance covers the novel attack surface — excessive agency, task-completion bias, cascading failures — that the committed code itself does not expose. Both layers apply.

🧪 SWE-bench — Evaluating Language Models on Real-World Software Engineering

Carlos E. Jimenez, John Yang, et al. — arXiv:2310.06770, Princeton & Stanford 2024 · arxiv.org/abs/2310.06770

BrassCoders treats SWE-bench as the canonical benchmark for measuring how well autonomous coding agents close real GitHub issues. The benchmark uses 2,294 issues from 12 popular open-source Python repositories; resolution rates measure the agent's ability to produce code that passes the repository's existing test suite, not just plausible-looking code. Agents that score well on SWE-bench produce code BrassCoders can scan — the benchmark output is ordinary Python, and BrassCoders's deterministic rules apply regardless of whether a human or an agent wrote it.

What it's good for: measuring autonomous agent performance on real-world software engineering tasks. Where BrassCoders draws from it: the benchmark framing BrassCoders uses to explain that agent-written code is ordinary committed code subject to the same static analysis.

🔧 SWE-agent — Agent-Computer Interfaces Enable Automated Software Engineering

John Yang, et al. — arXiv:2405.15793, Princeton 2024 · arxiv.org/abs/2405.15793

BrassCoders treats SWE-agent as the reference implementation for the agent-computer interface pattern that autonomous coding agents use. SWE-agent builds a structured interface between the language model and the computer — specialized commands for file editing, navigation, and shell interaction — rather than dumping a raw terminal at the model. The output is committed code; BrassCoders scans whatever lands in the repository, whether a human, a prompted assistant, or an autonomous agent produced it.

What it's good for: the agent-computer interface architecture that autonomous coding agents use to write and commit code. Where BrassCoders draws from it: the reference architecture BrassCoders cites when explaining how autonomous agents produce committed code that static analysis applies to.

🔧 OpenHands (OpenDevin) — An Open Platform for AI Software Developers as Generalist Agents

Xingyao Wang, et al. — ICLR 2025 · arxiv.org/abs/2407.16741

BrassCoders indexes OpenHands as a production-grade open-source autonomous coding agent — one of the best-performing systems on SWE-bench. OpenHands agents write, test, and commit code with minimal human involvement; the output lands in a repository like any other commit. BrassCoders scans those commits the same way it scans human-authored code, applying the same 12 scanners and producing the same YAML findings file the AI assistant reads for triage.

What it's good for: a production-grade open-source autonomous coding agent and its SWE-bench performance. Where BrassCoders draws from it: the primary example BrassCoders uses to illustrate that agent-written code lands in the repository and is subject to the same deterministic scan.

📊 OWASP — Agentic AI Threats and Mitigations

OWASP AI Security Project, 2025 · genai.owasp.org

BrassCoders treats OWASP's agentic AI guidance as the taxonomy for the novel attack surface autonomous coding agents create. The OWASP document covers agent-specific threats that do not appear in standard software security frameworks: excessive agency (agent with more permissions than the task requires), task completion bias (agent takes shortcuts that bypass security checks), and cascading failures in multi-agent pipelines. BrassCoders's static scanner addresses the code the agent produces; OWASP's mitigations address the agent's runtime behavior and permission scope — both layers apply.

What it's good for: the agent-specific threat taxonomy covering excessive agency, task-completion bias, and cascading failures. Where BrassCoders draws from it: the runtime threat framing that complements BrassCoders's source-level scanning of agent-produced code.