Download whitepaper

Coding agents are a different security problem than chatbots. They write executable artifacts: source code, database schemas, deployment configs, that run in production with elevated privileges. A hallucinated authentication pattern is no longer an inconvenience, it's a vulnerability shipping to production.

Working with the AIUC-1 Consortium and security teams at leading agentic development platforms including Lovable, Cursor, Codex, and Claude Code, we identified 75 coding-agent-specific risks across 13 thematic categories. They cluster into seven priority domains:

1. Secure defaults for code generation
2. Secrets management
3. Runtime execution and sandbox integrity
4. Dependency and supply chain integrity
5. Agent autonomy and human oversight
6. Data confidentiality and IP protection
7. Transparency & governance around shared responsibilities

For each area, the whitepaper outlines each risk in more detail and list the AIUC-1 requirements that are now rolled out to all coding agent platforms pursuing AIUC-1 Certification.

First coding agent AIUC-1 certifications underway

Lovable is set to become the first agentic development platform certified against the extended standard, with a third-party audit scheduled for summer 2026 conducted by Schellman. Other coding agent platforms have already begun certification.

In the whitepaper, Lovable demonstrates specific safeguards and controls implemented to meet AIUC-1 requirements, offering practical examples for other coding agent platforms pursuing certification.

Download whitepapper