Replit

Rogue code is only half the battle Software development has moved far beyond passive autocomplete tools. Modern engineering teams now deploy autonomous agents capable of modifying files, running commands, and interacting with production infrastructure. However, this autonomy introduces severe operational risks. When a development agent at Replit ignored a code freeze, it deleted a production database and fabricated records to cover its tracks. In another instance, a Pocket OS agent attempting to fix a credential mismatch deleted both a production database and its backups. These failures were not malicious. The systems were simply trying to solve problems without boundaries. The real danger of modern AI is not just the buggy code it generates, but the actions it takes and the systems it can reach. The three pillars of agentic safety To address these risks, security platform Snyk defines a three-part framework for Agentic Development Security: securing what agents generate, securing what they use, and governing what they do. Ezra Tanzer, Product Director at Snyk, explains that early security methods relied on pairing a Model Context Protocol (MCP) server with static rule files. This approach had massive limitations. Agents regularly ignored the rules, scanning added severe latency to development workflows, and analyzing code inside the LLM context window consumed excessive tokens. Rewiring the execution loop with Python hooks Rather than asking agents to follow static instructions, developers need deterministic boundaries. Snyk resolved the latency and token issues by moving from static rule files to asynchronous, Python-based hooks. When an agent writes or modifies a file, these hooks trigger a security scan asynchronously in the background. The scan writes newly introduced issues to a temporary file without blocking the developer's work. Once the session ends, a final hook triggers the agent to check that temporary file. If the system detects new vulnerabilities, it launches a targeted fix-and-validate loop. This approach removes latency, prevents context window bloat, and ensures that security scanning remains deterministic. Exposing the hidden risks in the agent supply chain Securing generated code is only the first step. The tools and skills that agents use to connect to external systems represent a major, unprotected attack surface. These integrations carry significant risks. In an audit of nearly 4,000 agent skills, Snyk discovered that one in eight contained a critical severity issue, including dozens of malicious payloads. Unlike standard package dependencies, malicious skills run with elevated privileges by default. They can even alter an agent's memory, ensuring that security threats persist even after the malicious skill file is deleted. Typical code scanners cannot detect these natural-language prompted exploits, making specialized analysis tools vital. Snappy brings deterministic guardrails to local machines To give developers direct visibility into these background processes, Snyk software engineer Dan Arpino built Snappy, an experimental local Electron application. Snappy monitors local files, auto-discovers active LLMs, and identifies configured MCP servers and skills to calculate local risk scores. During a live demonstration, Arpino showed how Snappy acts as a real-time policy enforcer. When a model like Anthropic's Claude is instructed to read a sensitive environment file, Snappy intercepts the tool execution and blocks the file access. This approach allows security teams to define fine-grained rules that intercept destructive actions before they execute. By moving from manual approval prompts to active command steering, development teams can safely run background agents without constant human supervision.