AI coding agents are writing and merging code. Access tokens remain active long after projects end. Permissions accumulate, and controls meant to protect production are bypassed.
BlueFlag Security’s inaugural State of Developer Risk report examines the human developers, non-human identities, and AI coding agents acting on enterprise code, alongside the tools and pipelines they work through.
Built on anonymized production metadata spanning tens of thousands of identities and active access tokens, the report shows where the development environment is left open:
Measured, not surveyed.
Agents are already working inside development environments before organizations have established which ones are approved.
Agents inherit permissions that let them bypass reviews, switch protections off, and grant permissions to others.
Permissions accumulate as roles and projects change and stay in place long after the work that required them has ended.
Tests and security scans can flag a problem without stopping the change.
The report connects who, and what, can reach the repositories, the permissions they hold, and how they behave to the controls that decide what reaches production.
The findings come from anonymized, aggregated production metadata across a representative subset of BlueFlag’s enterprise customers, with engineering teams ranging from a few hundred to several thousand developers.
The analysis examines identities, permissions, and activity without reading, storing, or copying source code.
Where standing access creates exposure
How AI coding agents, the most powerful identities in the environment, are changing it
Which behaviors warrant a closer look
Where development controls break down
What your team can do next
Download The State of Developer Risk 2026 for 25 findings on the identities, tools, and pipelines shaping risk across the software development lifecycle, plus recommendations for security and engineering leaders.
Download the Report
BlueFlag Security is a Developer Risk and Governance Platform, the system of record for all developer risk: every identity, every tool, and every pipeline in the development ecosystem. It gives security and engineering teams full visibility and governance over every identity operating in the development environment: human developers, non-human identities, and AI agents. BlueFlag connects read-only in under 5 minutes, never touches or copies code, and delivers a full findings report within 48 hours.
