Insights

Securing agentic development at enterprise scale with Anthropic Claude Code

Dr. Adnan Masood, Chief AI Architect, UST

Ten security challenges every CISO and Chief AI Officer should engineer for across the AI-driven development lifecycle, and how UST's Anthropic partnership, from certification and curriculum to frontier-lab guidance, helps us address them at scale.

Agentic coding with Anthropic's Claude is the strongest productivity lever in enterprise software today, and it introduces a new kind of privileged user — one that reads your repositories, runs commands, and holds credentials at machine speed. The security blueprint already exists; Anthropic wrote it, and the enterprise's work is disciplined adoption. Below are the ten security challenges we engineer for across the AI-driven development lifecycle, from indirect prompt injection to auditability, and the practical control that contains each one: sandboxed execution, egress and MCP allowlists, short-lived agent identities, security gates in CI, immutable logging, and humans on every destructive path.

UST's Anthropic partnership plays a vital role in how we secure that user for our customers and partners: it provides our engineers with direct access to Anthropic's partner training materials, security curriculum, and certifications. The teams deploying Claude Code across the AI-driven development lifecycle (AIDLC) — legacy modernization, test generation, large-scale refactoring, for clients in banking, healthcare, and insurance — are trained on the platform by the lab that built it. The question every security and AI leader asks is the right one: how do we capture the multiplier while keeping the enterprise security model intact?

Our answer begins with an acknowledgment: the security blueprint for Claude already exists, and Anthropic wrote it. Claude Code ships with read-only defaults and granular allow/ask/deny permissions, trust verification for new codebases and MCP servers, a sandboxed execution environment with filesystem and network isolation, organization-enforced managed settings, OpenTelemetry monitoring, and commercial terms that exclude customer content from model training by default, plus zero data retention on eligible enterprise surfaces. Claude is an ecosystem with its own security model. The enterprise's work — and ours — is faithful, disciplined adoption: composing Anthropic's primitives with the security estate you already own into a zero-trust operating model for a new class of identity.

DIVIDER

One sentence that does the heavy lifting

Treat the coding agent as a privileged non-human identity (NHI): a machine user that processes untrusted input, holds real credentials, and can execute code. The principle runs through Anthropic's own security guidance, and every control that follows is a consequence of taking it seriously. Agents earn the same rigor as any high-privilege account — separate identity, least privilege, contained execution, immutable audit — plus AI-specific layers for the ways language becomes action.

DIVIDER

Ten security challenges with agentic software development

1. Indirect prompt injection. Everything an agent reads — a README, an issue, a build log, a webpage, a tool result — can carry instructions, and no model separates trusted from untrusted text with certainty. So we design for containment: network-restricted sandboxes, egress allowlists, human approval on side-effecting actions, and Claude Code's isolated context for fetched web content. A successful injection should land in a dead end instead of a credential store.

2. MCP and connector governance. The Model Context Protocol is what makes Claude a first-class participant in the enterprise toolchain; it deserves first-class identity discipline. We allowlist MCP servers through managed settings checked into source control, verify provenance, enforce OAuth 2.1 with RFC 8707 resource indicators, refuse token passthrough, and require re-approval when tool definitions change.

3. Non-human identity and least privilege. Give the agent its own short-lived, workspace-bound identity, separate from the developer, with just-in-time access and step-up authorization for destructive operations. Workload identity federation replaces standing secrets with credentials that expire before they can be abused.

4. Data governance for persistent AI stores. Anthropic's commercial defaults are strong; the remaining exposure is the enterprise's own. Projects, artifacts, connector caches, and logs accumulate secrets and regulated data outside traditional governance. Inventory these stores, apply retention and data loss prevention, deliberately scope sharing, and rotate keys on a schedule rather than after an incident.

5. Execution boundaries. In agentic development, repository content joins the executable surface—hooks, configuration files, devcontainers. Keep clients current with enforced auto-updates, preserve trust dialogs and read-only defaults, run higher-risk work in ephemeral containers, deny read access to secret paths, and prohibit permission-bypass modes on any credentialed host. Anthropic's documentation is unambiguous about these defaults; our contribution is to enforce them fleet-wide through managed settings.

6. Excessive agency. An agent needs no vulnerability to cause damage; permission plus a misread instruction is enough. Keep humans on destructive and production paths, enforce hard separation between development and production, set cost and action limits, and wire a kill switch before you need one.

7. The skills and plugin supply chain. Agent Skills, hooks, and MCP server definitions are code and deserve code's lifecycle: provenance checks, version pinning, security review before install, and sourcing from curated directories — Anthropic reviews listings for its own — rather than unvetted community registries. An internal signed registry makes the paved road the easy road.

8. Assurance for generated code. Treat AI-authored diffs as untrusted until the pipeline proves otherwise: static analysis, software composition analysis that blocks unrecognized packages, secret scanning, and mandatory human review for every new dependency. Guard the tests, too — a quietly weakened test defeats the entire gate.

9. Shadow usage and fragmented governance. Prohibition drives usage onto personal accounts. Consolidate on enterprise plans with SSO and SCIM provisioning, block consumer endpoints at the gateway, and publish an acceptable-use policy naming prohibited configurations. Enablement earns its keep here as a security control: engineers certified through Anthropic's curriculum, working on managed plans, have little reason to circumvent governance. Centralized identity restores what incident response depends on: visibility and revocation.

10. Auditability and the human gate. Automation bias and approval fatigue erode review; thin logs erode response. Ship Claude Code's OpenTelemetry stream into the SIEM with immutable retention, record prompts, plans, tool invocations, and approvals, and keep allowlists narrow so the prompts that remain still carry meaning. When something does go wrong, attribution — human, agent, or manipulated agent — should take hours, never weeks.

DIVIDER

The advantage on the other side

Every control above is buildable with capabilities Anthropic ships today and the DevSecOps investments most enterprises already own. That is the opportunity in agentic AI security: the organizations that operationalize governed autonomy now will modernize faster, review deeper, and ship more securely than those still waiting for the risk conversation to settle.

Our posture is deliberately collaborative. Anthropic sets the security model for its ecosystem and sees these systems first; UST brings the operating discipline of regulated industries — identity, audit, DevSecOps — that turns frontier-lab guidance into governed production; what we learn in the field sharpens the practice. Contained and well-governed, Claude becomes exactly what it should be: a genuine multiplier in serious engineering, within a perimeter designed for it.

DIVIDER

Where to start

If your organization is adopting Agentic Coding or planning to do so, UST can help you deploy it with controls in place from day one. Our Anthropic-certified engineers have implemented Claude Code across the AI-driven development lifecycle in banking, healthcare, and insurance, pairing Anthropic's security guidance with the identity, audit, and DevSecOps discipline regulated industries require.

Start with a working session: we will assess your posture against the ten challenges above, sequence the controls that reduce blast radius first, and leave your team with a roadmap it can execute.

Connect with UST's AlphaAI to schedule the session

DIVIDER

FAQ Schema Content

Q: What is agentic software development?

A: Agentic software development uses AI agents that can understand context, write code, execute tasks, and interact with enterprise tools with varying levels of autonomy.

Q: Why is Anthropic Claude Code security important?

A: Claude Code agents can access repositories, tools, and credentials, making governance, identity controls, and auditability essential for enterprise adoption.

Q: What are the biggest security risks in agentic coding?

A: Key risks include prompt injection, excessive permissions, MCP governance issues, supply chain vulnerabilities, shadow AI usage, and insufficient auditability.

Q: How can enterprises securely deploy Claude Code?

A: By implementing least-privilege access, sandboxed execution, managed settings, human approval gates, immutable logging, and DevSecOps security controls.

Q: How does UST help organizations secure agentic development?

A: UST combines Anthropic-certified expertise with identity, audit, governance, and DevSecOps practices to help enterprises deploy Claude Code securely at scale.