There is an adage particularly among those doing sprints in the once zeitgeist Agile world, and it is old enough now that like me that adage has probably crawled it’s way towards the moribund status of cliché, which was: “Move fast and break stuff.”
Some of you will shudder when you hear that and make the sign of the holy transistor, others will let their eyes fill with wistful tears. Me, as I said, I’m old, I was tired of the next newest shiniest thing to be a zeitgeist long before that phrase. I predate Agile all the way back to the era just before rapid application development.
But move fast and break stuff still stays with us and it has wormed its way into a supercharged new reality. And it has taken a far more dangerous turn in our uber-era of automated AI agents, because they move stupidly fast and they can break stuff you didn’t even know existed.
We’ve all seen the horror stories of automated systems going off the rails (yes I did discuss this at some length previously in this article: https://www.shadowcat.co.uk/2026/05/01/a-dark-turn-in-coding/). They seem to vary from the mildly amusing to the apocalyptic with opinions wildly gyrating between those states. But when companies face these issues they usually try to fix them at the firewall or permissions level, or sometimes they don’t have a care to fix them at all. There are a number of tools that are available, and some very interesting services such as this: https://www.xda-developers.com/finally-found-vibe-coding-tool-trust-home-lab-ai-tines-3b/, to help mitigate this issue. But the real problems might be knowing how to use them or knowing what you need to use.
For me the fix that you need to apply, or the methodology you must employ, has to happen at the process level of your journey. You need to have systems and processes in place before you start to integrate the tools, and you need to be more thoughtful and tactical about how you deploy and integrate them.
If you are bringing, or have already brought, AI agents into your development lifecycle, you have to actively design processes that prevent a runaway agent from causing real-world damage. You have to have systems in place to know how the tool can best support you. And you might need a little hand holding from people who have used the tools before, and more importantly, lived in an environment where things were not done automatically for you so they know the differences. It is hard to be thoughtful, considered, and reflective if you have no experience to compare to.
There are, we at Shadowcat think, some absolute baseline security rules that should never be broken, the biggest of these being:
Production API keys, credentials, and deployment scripts must NEVER live in a repository where an AI tool can access them.
Because an LLM that has hallucinated its way into deciding it “needs” production access to solve a prompt it can and will look for those keys. If they are in the environment the agent will use them. The consequences are to be held up as another amusing or apocalyptic example.
You don’t have to ban automated tools to keep your company safe. You just need to stop putting the tools into positions where catastrophic errors are possible. Treat automation as a powerful tool that requires strict human boundaries. You need to be conscious and aware of the choices you should make before you start to let the tools develop with you. If you don’t know what you are doing you are not ‘vibe coding’ a new generation of super applications, you are walking blindfolded into a minefield.
How is your organization ring-fencing your production environments from automated tools? How are you dealing with matters of privacy? What is the data flow, back-up, security mitigation? There are a lot of questions that experienced teams don’t ask themselves because they are automatically considered, you cannot automate these into existence, you have to know they are there to provide a solution that meets them.
Read more about establishing a healthy process-level boundary for AI tools by Mike Whitaker on our blog: https://www.shadowcat.co.uk/2026/05/08/ai-is-here/ and https://www.shadowcat.co.uk/2026/07/30/law-0-and-how-to-circumvent-it/
No responses yet