Enterprises are adopting AI coding agents faster than their security programs were built to handle, and a new kind of adversary is raising the stakes. At the Snyk AI Security Summit, the AI Native Dev podcast sat down with Manoj Nair, Chief Innovation Officer at Snyk, to explore where enterprise agent adoption actually stands, what holds the laggards back, and why security leaders are suddenly willing to rethink trade-offs they have defended for decades.

Nair spends much of his time with large, heavily regulated organizations, from global banks to Fortune 100 companies. That vantage point makes his read on enterprise AI adoption worth a close look, and the conversation with host Guy Podjarny moved quickly from adoption patterns to the security model that has to follow.

A 2x2 for enterprise AI adoption

To make sense of where organizations sit, Nair plots them across two dimensions: whether they are using AI or building with it, and whether that involves assistants or agents. Nearly every enterprise is using AI, with tools like Gemini woven into everyday software. A large share, perhaps 50 to 60 percent, remain in what he describes as the copilot era of autocomplete and sidebar chat, with the developer still orchestrating every step.

The next quadrant is building with agents, where tools like Cursor's cloud agents and Claude Code let a developer hand off a task and close the laptop. The last is shipping production agents, internal or external, which Nair sees as the place where the software factory is coming to life most.

What moves an organization from one quadrant to the next appears to be less about tooling than about leadership. Nair described financial institutions where the CEO and leadership team use agents themselves on weekends. In one case, a rollout of 50,000 Claude Code agents that would normally be a year-long project was scheduled for August, then pulled in to July 10th. "Top-down pressure really works," he observed.

Three risks of agentic coding: output, supply chain and behavior

Once leadership pushes, the conversation tends to become the CTO versus the CISO. Nair breaks the security concerns of agentic coding into three buckets.

The first is output. Agents can write insecure code or pull in risky dependencies, much like developers do, only faster. The second is a new supply chain. Snyk began by securing open source dependencies, and Nair argued that "skills and MCP servers are the new npm," adding that "three lines of English can be malware." Understanding the intent of a skill becomes a security question in its own right. Podjarny added slopsquatting to the list, where agents hallucinate package names that attackers then register.

The third is behavior. Nair pointed to the PocketOS incident, in which an overly permissioned coding agent deleted a company's production database, as a turning point for many CISOs. It reframed agent risk as a safety problem rather than only a code quality one.

In practice, many banks that say everyone is using Claude Code are running those agents in tightly confined setups: sandboxes, separate agent identities and no open internet access. Nair sees this as valuable but limiting, closer to an extension of the copilot era than a true software factory. Podjarny offered a pragmatic counterpoint. If running agents offline is how an organization gets going, that is fine, because the most useful thing to do in this era is to start.

Accountability and the operational risk trade-off

Compliance is another brake. Many organizations believe regulation requires a human approver on every change, and some have rewritten job descriptions to say engineers own agent output regardless of how it was produced. Nair has started asking which law actually requires that, or whether it is simply interpretation. A poll at a Snyk customer summit suggested the more AI-native organizations had already decided responsibility is shared across the organization, and that they would back the risk in exchange for the benefits.

The sharper shift is driven by what Nair calls the autonomous attacker. Models that can chain exploits at machine speed have turned long-tolerated security backlogs into an urgent liability. Someone described Anthropic's Mythos model to him as "a margin call on your technical debt." Snyk is seeing backlogs grow roughly 10x year over year, with eight new issues created for every one that gets fixed.

That has produced a striking change in tone. Podjarny noted that CISOs at very large, uptime-minded organizations are now saying they would accept an outage in exchange for patching faster, and one felt able, for the first time, to propose pausing development to pay down security debt. Nair framed this as a possible silver lining: "sometimes the crisis is what you need to change the culture."

Securing the software factory with agentic remediation

Podjarny separates the problem into securing the product and securing the factory. On the product side, Nair described how application security is moving into the agent loop itself. Rather than flagging a vulnerable or abandoned package after the fact, Snyk Studio feeds that context to the agent at the moment it chooses a dependency. Prevention at that point can be more effective than shifting left to the developer, because agents follow instructions without reluctance, as long as the guidance is fast and does not overload their context.

For the existing backlog, Nair described a progression from security skills for coding agents, which helped customers such as Labelbox and Relay Network reach backlog zero, to a dedicated remediation agent. On Snyk's own benchmark, it reportedly achieved a substantially higher fix success rate than a general-purpose agent while using fewer tokens. Podjarny called this the value of a harness: a purpose-built system rather than context alone. The final step, autonomous merging, depends on building enough confidence for policy to let certain classes of fixes through without a human.

What enterprises still need to trust AI coding agents

Looking ahead, Nair expects sandboxing to become mainstream at the infrastructure layer, but argues it does little at the application layer. Two capabilities remain unsolved: an identity stack that understands an agent's intent and grants permission on the fly, and behavioral controls that can recognize when an agent is heading somewhere it should not and steer it back on the rails.

Both depend on something enterprises have rarely managed well, which is combining knowledge of what the business is trying to do with an understanding of what is secure. Nair suggested agents may help bridge that gap, while Podjarny pointed to skills as the place where that intent can be codified.

The conversation offers a grounded view of where enterprise agentic coding stands today, and it is worth a listen for anyone deciding how far to let agents run inside their own organization. How is your team balancing agent autonomy against security?