Skip to content

Closed-loop secure code generation

Definition

Closed-loop secure code generation moves security guidance out of documents developers are asked to follow and into the instruction files and shared skills a coding agent loads automatically, so a rule shapes code at the moment it is written rather than being checked after the fact. The loop closes at the other end: every newly discovered bug class is treated as an edit to those instructions, converting a single finding into a standing generation-time control against its own recurrence.

Explanation

The older arrangement had a structural weakness that had nothing to do with the quality of the guidance: a team observed recurring vulnerabilities, wrote secure-coding guidelines, and then depended on a developer having read the right guideline at the right moment, which made the control hard to enforce and rarely standardised across teams. When an agent writes most of the merged code, the guidance gains a reliable attachment point — convention files and org-wide skills are loaded at session start on every session, so a rule placed there is applied by construction rather than by human recall. The return path is what makes it a loop: when a review agent or an incident surfaces a bug class, remediation is not only the patch but an amendment to the instruction that produced the vulnerable code. Two refinements sit on top. The review step can be invoked as the agent's last action before opening a pull request, and more recently can run concurrently with generation, where a security-guidance plugin reads the conversation and code as they are produced and repairs issues in the same session — collapsing the discover-and-fix interval to nothing. Enforcement strength is then a placement decision: an instructed step the agent may skip, a hard pre-tool-use gate that blocks until review runs, or a gate held further downstream in CI, which is where the account's own team put it. The same auto-loading channel also carries non-security nudges, such as steering non-technical teams onto a sanctioned hosting platform instead of shadow IT. This is a first-person account by the vendor's own Deputy CISO describing its practice on its own tooling: the mechanism is stated clearly and transfers to any agent that auto-loads convention files, but no measurement of vulnerability reduction attributable to the loop is offered.

Key Properties

  • Guidance lives where the agent reads it every session — instruction files and org-wide skills — not in documentation a human must recall
  • The loop closes only when a discovered bug class is written back into the instruction that generated the code
  • Review can run during generation in the same session, not only at pull-request time
  • Enforcement strength is a placement choice: instructed step, hard pre-tool-use gate, or CI gate
  • The same auto-loaded channel that makes the control reliable is what makes it worth attacking

Relationships

  • Skill-enforced development workflow — generalises this delivery mechanism beyond security, putting an entire process into files the agent loads at the moment of work instead of into documentation a human is asked to remember
  • Non-text channel injection — attacks the channel this practice depends on, since an auto-loaded convention file shapes generated code just as reliably when an attacker wrote it
  • Governing the automation loop — is what keeps this loop from silently opening, because a bug class that never gets written back and a skill that has gone stale both degrade the control without raising an error
  • Split-payload prompt injection — split-payload prompt injection is exactly the kind of newly-discovered bug class closed-loop secure codegen's loop converts into a standing instruction-file edit — once identified, the fix becomes a rule every future agent loads warning it not to treat image content as authoritative instruction.

Applications

Encoding an organisation's recurring vulnerability classes as agent instructions and skills so newly generated code complies by default; making the write-back to those instructions a required part of closing an incident or a review finding, rather than stopping at the patch.

Sources

  • https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle

See Also