AI Agents in Developer Workflows: Why Autonomy Becomes a Security Risk

TVS News AI, editorially supervised, presents AI Agents in Developer Workflows: Why Autonomy Becomes a Security Risk.

AI agents write code, call tools, and make decisions — all without asking. That sounds like a gain in efficiency, but from a security standpoint it's a risky bet: The more autonomously an agent acts, the larger the attack surface becomes. A new guide on Golem.de sums this up in a sentence that serves as both a warning and a to-do list for developer teams.

Author Klaus Manhart, who works in the fields of security and cloud computing, shifts the focus in his piece from model security to the agents' scope of action — that is, to what an agent is actually allowed to do on the basis of the model.

The more autonomously AI agents act, the larger the security risk becomes. Companies must therefore not only protect the models, but above all limit their scope of action.

Why the Model Alone Is Not the Risk

The usual security debate revolves around the model itself: training data, guardrails, filters for harmful prompts. That is not wrong — but it falls short as soon as agents act independently. Anyone who allows an AI agent to clone repositories, create branches, deploy packages, or send emails hands it a bundle of tools that can no longer be controlled with model filters alone.

With every additional tool, the attack surface grows — through prompt injection, compromised tool APIs, or simply faulty logic. Manhart therefore argues that the security focus must shift: away from the model, toward the action.

What "Limiting Scope of Action" Means in Practice

The core recommendation from the Golem piece is clear: Don't harden the model, but rein in its radius of action. In security practice, this is not a new principle — least privilege has been part of the toolkit for years. With AI agents, however, it takes on new urgency, because a misdirected agent can cause more damage in minutes than a classic script can in hours.

Three questions help teams realistically calibrate the scope:

Which tools is the agent allowed to call at all? Rather than an open toolbox, prefer a short, vetted list — everything else is a point of entry.

Which actions still require human approval? Critical steps such as deploying to production or deleting data should never run automatically.

Do we see what the agent does? Without complete logging of every action, forensics after an incident becomes practically impossible.

Bottom Line

AI agents are not a risk per se — the risk arises from the scope you give them. Anyone working with autonomous systems should ask not only what the model can do, but above all what it is allowed to do. Klaus Manhart's guide on Golem.de provides the right framework for thinking about that.