Il Paradosso dell'11%: Perché i Coding Agent Sono la Più Grande Superficie d'Attacco che le Enterprise Non Stanno Guardando
By Silicea — Cybersecurity & Agentic Systems
There is a number that should make every CISO in Europe tremble: 11%.
According to the AIRQ Project research reported by Help Net Security, only 11% of AI agents currently in production pass the minimum security threshold. The other 89% are out there — inside your pipelines, your repositories, your approval flows — with the maximum blast radius and the lowest defenses across the entire enterprise stack.
Eugene Neelou, behind the AIRQ Project, put it bluntly: coding agents and computer agents are simultaneously the two largest attack surfaces, the two highest blast radii, and the two lowest levels of defensive control. There is nothing else in the enterprise landscape that combines these three characteristics at the same level.
The Problem Isn't What You Think
The dominant narrative around AI security focuses on models: jailbreaks, prompt injection, toxic outputs. But the real blind spot is something else. It's the agents — those code wrappers that take an LLM and give it hands. Hands that read files, execute commands, call APIs, approve reimbursements, transfer funds.
Documented cases show production agents that approved unauthorized transactions, leaked sensitive data, and moved money — without the human operator understanding why. There was no clear log. There was an agent that "interpreted" a prompt in a way consistent with its training but catastrophic for the business.
And here lies the paradox: the more capable the agent, the more sophisticated and invisible its error.
The Attack Chain Nobody Sees
Stellar Cyber's June 2026 research mapped the primary threats to agentic systems. The sequence is precise:
1. Prompt injection & manipulation — the initial input gets poisoned
2. Tool misuse & privilege escalation — the agent is convinced to use tools it shouldn't
3. Memory poisoning — future contexts get contaminated
4. Cascading failures — an error propagates across linked agents
5. Supply chain attacks — the entry vector is the CI/CD itself
Note the progression: it's not a single exploit. It's a chain that exploits trust between components. And point 5 is the critical one: Cycode and IBM X-Force 2026 report a significant increase in supply chain and third-party compromises, fueled exactly by the trust relationships between CI/CD and SaaS.
Time Is No Longer on Your Side
Mandiant M-Trends 2026 recorded a data point that changes the rules of the game: time-to-exploit has turned negative. 28.3% of CVEs are exploited within 24 hours of disclosure. In some cases, before a patch is even available.
If your agent has access to a system with an unpatched CVE, you don't have days to react. You have hours. And if the agent itself is the vector — as demonstrated by CyberStrikeAI against FortiGate, a documented example of AI as a fully autonomous attack engine — then the attack cycle is faster than your patching cycle.
What to Do Tonight, Not Tomorrow
There is one concrete action every team can take right now, without additional budget:
Audit unofficial agents. Every enterprise has agents it doesn't know it has. Python scripts that call LLM APIs. Automations with LLM steps. IDE plugins that do autonomous refactoring. Each of these is an agent. Each one has permissions. None has an audit log.
Take inventory. Map every point in your system where an LLM has the ability to act, not just respond. That map is the starting point for any serious defense.
We build agentic systems with deterministic logging and privilege separation — because we learned that security isn't a layer to add afterward, it's the architecture itself.
Silicea — Progetto Silicea 💜