Emerging Security Solutions for Automated Software Factories

Enhancing Security in Automated Development

As the landscape of software development evolves toward increased automation, security measures are becoming imperative. Recent offerings from Harness and Chainguard aim to embed security within the framework of automated software factories, addressing the risks posed by agentic coding.

New Tools Launched

On October 8, Harness unveiled its newly acquired Cosmos software factory. Shortly after, on October 14, Chainguard launched Workspaces and Checks, which are designed to bolster security in AI-driven software development.

Both Cosmos and Workspaces utilize isolated virtual machines (VMs) to operate coding agents. While Cosmos orchestrates numerous parallel agent environments, Checks enables agents to execute tests and rectify issues dynamically, bypassing the conventional continuous integration (CI) pipeline.

Shifting Industry Dynamics

Industry experts observe that these developments signify a larger trend towards greater autonomy in the Software Development Lifecycle (SDLC), coupled with an urgency to address security concerns. According to Katie Norton from IDC, agents are increasingly seen as integral infrastructure elements.

“Organizations are moving toward agentic development as the default, and the reduction in human code reviews is a growing trend,” she said.

Despite the growing reliance on AI coding assistants, a significant proportion of developers express concerns regarding security. A recent IDC survey revealed that 74.6% of participants believe such tools elevate the risk of integrating code without a proper understanding of its security implications.

Isolated Execution Environments

The adoption of ephemeral microVMs in both Cosmos and Chainguard Workspaces enhances security by providing agents with a distinct, temporary execution environment. This strategy mitigates the risks associated with running untrusted code.

Suresh Gangula, a DevOps engineer at Nike, emphasized that isolated VMs contribute to security by limiting access and reducing potential damage in the event of a security breach.

“A disposable VM ensures that if an agent’s code causes an issue, its impact is contained,” Gangula explained.

Traditional CI environments often possess long-lived secrets, making them attractive targets for malicious actors. In contrast, the new systems focus on minimizing exposure to these vulnerabilities by maintaining strict boundaries.

Limitations of Current Systems

With the capability to run numerous agents simultaneously, the risk associated with a single compromised component is magnified. If an agent encounters an unreliable dependency, the results could be extensive.

As software factories empower agents to execute code, access dependencies, and interact with various systems, the importance of security mechanisms increases. “Mistakes in this context can propagate more quickly than in traditional environments,” noted Gangula.

The Role of Continuous Verification

Cosmos and Checks facilitate continuous verification by allowing coding agents to automatically respond to failed tests and make necessary adjustments in real time. Chainguard’s Checks integrate testing directly into the agent's development workflow, eliminating the need to wait for the CI queue.

“You can consider it an alternative to GitHub Actions,” remarked Sam Katzen, Chainguard’s product marketing director.

However, transitioning from traditional CI systems may present challenges, as established pipelines embody years of company-specific logic and preferences.

Autonomy in Software Development

The potential for automating software engineering tasks is substantial, with Jyoti Bansal, co-founder of Harness, estimating that automation could handle 40-50% of coding responsibilities. Nonetheless, skepticism remains regarding the complete delegation of the SDLC to agents without human input.

“While agents are effective for specific tasks, achieving full automation from ticket to production remains rare,” Gangula stated, highlighting the need for human oversight in more complex scenarios.

Chandrasekhar Katru, a software engineer at Wells Fargo, echoed this sentiment, expressing doubt that a fully autonomous software factory has been achieved.