Mark McLaughlin, Product Marketing Manager | Aurascape
September 3rd, 2026 | 🕐 6 minute read

Introduction

Application security grew up around a predictable sequence of events. A developer writes code. The code becomes an artifact. The artifact gets reviewed: static analysis scans it, a colleague reads the diff, the pipeline runs its checks. Risky code, the theory goes, eventually takes a form that someone can review.

AI coding assistants broke the sequence. Today’s assistants act: in a single session, an agent reads repositories, writes files, runs commands, and calls tools, inside the same workflows developers use to ship software. The risky moment now happens live, inside the session, before any artifact exists to scan. By the time a pull request appears, the assistant may already have read the repository, sent code to a model, and run commands in the shell.

Security teams are not behind here; their tools are. The tools that watch code are pointed at the wrong moment, and the tools that watch traffic were not built to read the AI interaction inside it. That is the gap Aurascape’s Coding Assistant Guardrails solution closes.

One session, five sensitive systems

Consider a bank’s platform engineering team: several hundred developers using coding assistants. Claude Code in the terminal, GitHub Copilot in the editor, Cursor as the editor itself.

Now count what a single AI-assisted session touches:

1. The proprietary codebase, because the agent reads it for context.
2. Secrets and credentials, because they live in configuration files and sometimes end up in prompts.
3. The package manager, because the agent installs dependencies.
4. Model Context Protocol (MCP) tools, because modern agents call them.
5. The shell itself, because the agent runs commands.

Take one ordinary task as an example: A developer asks the assistant to fix a failing integration test. The agent reads the test, then the service it exercises, then the configuration the service loads, where the credentials live. It pulls a dependency, runs the test suite, and proposes a commit. One instruction, and the agent has touched code, secrets, packages, and the shell.

Multiply that across a large team, sprint after sprint. Six distinct risks rear their heads in each session:

1. Source code leaving through the conversation
2. Secrets in prompts
3. Unsafe generated code and vulnerable dependencies
4. Prompt injection
5. Destructive commands
6. Unapproved models and licenses

Any one of these risks can appear beside the others, which is why the control has to sit where all six do: in the session.

What traditional security cannot see

The controls most organizations already run, static analysis, file-based data loss prevention (DLP), and secure web gateways, are still important and reduce risk. However, AI-assisted sessions slip between them in specific ways.

Static analysis and code scanning inspect code after it exists, at commit or in the pipeline. That work stays essential. But there is a lot a scanner cannot do for AI coding sessions:

• It cannot see a secret pasted into a prompt, because the secret never becomes code.
• It cannot stop a destructive command, because the command runs long before the pipeline does.
• It starts at the artifact, and by the time an artifact exists, the agent has already read the repository, called its tools, and run its commands.

File-based DLP acts on file movement: uploads, attachments, transfers. A repository read by an agent is none of those. Source code can leave through the conversation itself, and the leakage path through a coding assistant looks nothing like the file transfers DLP was tuned for.

Secure web gateways judge destinations: allow or block the domain. Coding assistants work differently. They stream over Server-Sent Events, WebSockets, Protobuf, gRPC, and MCP, they hold long sessions, and the risk lives inside the interaction, which the gateway was never built to read. A gateway that tries to inspect deeper without decoding these protocols sees less than the session carries.

The alternative is worse. To scan traffic it cannot decode natively, a gateway has to hold the stream back until it has a complete payload to inspect. The assistant stops streaming; responses that felt instant now arrive in delayed chunks; suggestions stall mid-keystroke, sessions seem to hang. Developers feel that immediately. Buffering a coding assistant breaks the flow of work.

That degraded experience turns into a security problem of its own, and manifests in security posture and IT review queues. Development leadership asks for a security exception so they can hit their deadlines. Each exception is small. But together, they become an ungoverned channel carrying the organization’s source code. A control stays in place when developers barely notice it.

Govern the session itself, while it runs

Aurascape starts from the control point that today’s AI-driven coding environments need: the live session. The platform decodes coding-assistant streaming protocols, so it understands what the assistant reads, sends, generates, and runs on those paths, and it preserves native streaming while it inspects. Developers keep the speed, and security keeps the control.

Here is how it looks, in five examples:

1. A pasted secret: A developer pastes a prompt with a cloud access key buried in a config block. Aurascape blocks or redacts the key in flight, before the model receives it, and captures the event as evidence for follow-up. The developer keeps working, and the secret never leaves.
2. A destructive command: An agent, asked to clean up a build, composes a recursive delete of a service directory, or prepares to push private code to a public remote. Aurascape catches the command on the wire, in the tool call the model streams back, before the client executes it. Policy can block it or hold it for confirmation, which turns a silent disaster into a checkpoint. The security team scopes which commands rate a checkpoint, so confirmation lands on destructive outliers and routine cleanups pass through.
3. A targeted agent: A model recommends a typosquatted package, or a spoofed link arrives in content the assistant fetched. Aurascape flags it before the developer acts on it, which turns an invisible supply-chain attempt into a visible, reportable event. The same inline position catches prompt injection hidden in READMEs, docs, and MCP outputs: a hijacked instruction telling the agent to post secrets to an external site is detected and neutralized before the agent acts. Aurascape’s own Aura Labs identified and reported an Agent Mode vulnerability in ChatGPT, which OpenAI confirmed and resolved.
4. A personal account: A developer signs into an assistant with a personal account. Aurascape redirects the user to the correct entitlement before the first prompt is sent, and before any source code can reach a model that may train on or retain it. This matters because as soon as the code base is read by the coding assistant, that code has left the building. And if the user is not working in the right account, that code might be retained or even trained on by the AI vendor. This is why immediate entitlement detection and redirection is vital when developers work with your proprietary code.
5. A risky environment: The environment around the assistant is governed too. Risky IDE plugins, extensions, and MCP servers are discovered as they appear, so security sets policy on what operates near enterprise code without turning every new MCP server into a ticket. MCP tool calls are visible down to their parameters. Where agent workloads grow past the coding assistant, the same platform governs the agent execution path.

An allowlist cannot keep up with the coding assistant fleet

One more thing separates coding assistants from classic application security: the tools keep changing. A developer organization runs a fleet of assistants, and each carries its own plugins, extensions, and MCP connections, each changing on its own schedule. New assistants appear. Existing ones gain agent modes. An extension installed by one team can change what a repository is exposed to.

A hand-maintained allowlist treats that fleet as a fixed population, which it is not. Aurascape’s continuous discovery works the other way: newly observed assistants, plugins, and extensions surface for review without anyone filing a ticket, and apps not yet in the catalog get signatures on a 48-hour SLA. Security’s question becomes: from the new AI tools surfaced this week, which policies did they inherit, and what activity already triggered policy actions? The same discipline that governs the broader AI application long tail covers the coding-tool fleet, where tool turnover is fast and the data is source code.

Coach the developer, keep the evidence

Enforcement style matters as much as enforcement capability. A control that fights the developer workflow ends up bypassed, and that is the control’s fault, not the developer’s.

Day to day: discovery finds the assistants in use, sanctioned and not. When policy stops something, the developer sees an explanation and a safer path, in the browser, the IDE, or the command line. Interventions can be guidance in the moment, and the redirect to the enterprise seat means the assistant keeps working, under the right license. The sanctioned path is the fast path, which is why Aurascape offers customizable coaching templates to help you keep users moving.

Generated code gets its own path. When an assistant produces risky code, Aurascape detects it and captures the evidence. The scanners keep inspecting artifacts at commit and in the pipeline; the session layer catches threats before they become artifacts.

Meanwhile, the evidence builds. Compliance and IP owners get auditable records of what each assistant accessed, generated, and sent, and evidence that proprietary code moves through sanctioned licenses. When the IP question arrives in an audit or a diligence exercise, the answer is on record. Security operations get conversation logs under role-based access control, so an investigation can reconstruct the prompts, responses, connections, and tool calls behind a policy flag. Engineering leadership sees which sessions run on enterprise seats and which run on personal logins. And leadership can ask about AI usage, risk, and policy in natural language through Auri™.

Proven where the code is the business

This model runs in production where the stakes are the clearest. A Fortune 500 financial services firm, under CIO and board pressure to speed development with AI, needed source code and client data governed inside the interaction for 15,000+ developers, while disruption from tools that could not enforce policy inline had pushed development leadership toward requesting a bypass. With Aurascape deployed alongside the existing secure access service edge (SASE) stack, steering only AI traffic, 15,000+ developers are secured across 8 targeted AI tools, with source code and client data governed inside the interaction and enterprise account access enforced. The assistants run as designed, and security keeps the evidence.

Developers keep the speed, security keeps control

Coding assistants are here to stay, and traditional security struggles to keep pace. Aurascape helps you keep control where it matters most: the live session where code is read, sent, generated, and run.

Establish guardrails there, and an engineering team keeps its assistants and its native streaming, while policy redacts the secrets, checks the risky commands, and keeps code on the licenses the organization approved.

If your developers already have their assistants, start with the Coding Assistant Guardrails solution brief, or book a demo.