Anand Naidu is a seasoned authority in the development space, possessing a rare mastery over both frontend and backend architectures. His deep technical fluency across various coding languages allows him to see the structural integrity of a system where others might only see a surface-level interface. As organizations rapidly integrate AI agents into their core operations, Anand has become a vocal advocate for a more disciplined, engineering-centric approach to security. He argues that the industry’s current fascination with “chat” has blinded many to the systemic risks that emerge when AI is granted the agency to act on its own. By focusing on the intersection of automated workflows and rigorous regression testing, he bridges the gap between innovative AI deployment and the traditional, battle-tested principles of software reliability.
The following discussion explores the critical transition of AI from passive conversational tools to active agents capable of executing complex tasks across internal infrastructures. We examine why the current industry focus on security checklists is fundamentally insufficient for the dynamic nature of agentic systems and why security must now be treated as a systems engineering challenge. The conversation highlights the “missing workflow” in AI development—the process of turning security failures into repeatable tests—and how open-source initiatives like the OWASP Agent Security Regression Harness are providing the necessary framework for this evolution. Through a focus on practical, outcome-oriented testing and CI/CD integration, we uncover a roadmap for maintaining trust in AI even as the underlying models and tools continue to change at a breakneck pace.
When an AI system moves beyond simple chat to calling tools and interacting with APIs, how does the security landscape fundamentally shift from a model problem to a systems problem?
The moment you grant an AI the power to call a tool, you are no longer just managing a dialogue; you are managing a series of high-stakes actions that can bypass traditional human oversight. In a simple chatbot scenario, a bad response is just words on a screen, but in an agentic system, that same model could be instructed to inspect repositories, query private databases, or even open tickets in a project management system. You can feel the weight of this responsibility when you realize the boundary of the system now includes every permission, data flow, and developer assumption that connects the model to the real world. A hidden instruction inside a support ticket isn’t just a clever trick; it’s a potential breach of a trust boundary that could lead to an agent leaking private context through an unauthorized tool call. We have to stop looking at the model in isolation and start looking at the entire systemic path—from the retrieval of untrusted content to the final execution of an API trigger—because that is where the real vulnerability lies.
Many organizations rely on security checklists to vet their AI deployments, but you argue that these are insufficient for agents. Why is a static checklist failing the modern developer?
Static checklists are like snapshots of a moving target; they capture the risks of yesterday but offer no protection against the iterations of tomorrow. While the industry has learned the vocabulary of threats—terms like prompt injection, indirect prompt injection, and excessive agency—knowing the name of a problem is not the same as containing it. It is incredibly disheartening to see a team fix a specific vulnerability in a prompt only to have that same failure quietly return during the next model update or a minor change in the application logic. A checklist doesn’t account for the next developer who unknowingly breaks a security assumption while trying to optimize a tool integration. We need a living workflow where a discovered behavior is captured in code rather than just being a checked box on a PDF that no one looks at after the initial release.
In traditional software engineering, a serious bug is turned into a regression test to prevent its return. How do we apply this rigorous discipline to the often unpredictable behavior of AI agents?
The most significant gap in AI maturity right now is this lack of a “missing workflow” that transforms a security postmortem into a permanent safeguard. When we find a serious bug in traditional software, we write a test so that the same failure can never return, and AI agent security should be held to that exact same standard. This means that a tool call that accidentally leaks sensitive context shouldn’t just be fixed; it should become a repeatable scenario that is rerun every single time the system changes. We need to treat these security findings as standard backlog items that are integrated into the very fabric of our engineering discipline. There is a certain “boring” but vital beauty in a clean project structure where every discovered failure is preserved as evidence, ensuring that our controls remain robust even as the model beneath them evolves.
Testing AI can be notoriously difficult because responses aren’t always exact; what does a functional, outcome-oriented test look like when using something like the OWASP Agent Security Regression Harness?
The challenge with testing agents is moving away from brittle checks that expect a specific sentence or a single string of text, which almost always fail in real-world conditions. Instead, we have to focus on outcomes: Did the agent cross a permission boundary it wasn’t supposed to touch, or did it call an unsafe tool that could compromise the database? The OWASP Agent Security Regression Harness provides a standardized way to ask these questions, focusing on practical and reproducible tests that can be applied to diverse frameworks like the OpenAI Agents SDK or LangChain. It’s about generating machine-readable results that prove a control still holds, rather than just hoping the model behaves itself under pressure. By focusing on these concrete system behaviors, we turn the “fuzzy” nature of AI into something that an engineer can actually run, maintain, and trust.
How can security teams practically integrate these regression tests into their existing CI/CD pipelines without slowing down the rapid pace of AI development?
To keep up with the speed of AI development, security cannot be a separate, manual step; it must be an integrated part of the release discipline. By using a harness to generate machine-readable results, security teams can plug these checks directly into their CI/CD pipelines, allowing every code change to be automatically vetted against known security scenarios. This approach, championed by leaders like Mert Satilmaz, moves us past theoretical ideas into a functional environment where wide adapter coverage ensures that whether you are using LangGraph or custom internal tools, the security checks remain consistent. It transforms the security process from a one-time review into a continuous systems engineering practice that provides clear evidence of safety. When you see a build fail because a new update reintroduced a potential data leakage path, you realize that this “boring” regression testing is actually the most powerful tool we have for moving fast without breaking everything.
What is your forecast for the future of AI agent security as these systems become more deeply embedded in sensitive enterprise workflows?
I believe we are entering an era where the “hype vs. fear” cycle will finally be replaced by a more sober and practical focus on repeatable engineering methods. As AI agents gain more leverage and become more connected to our most sensitive systems, the organizations that succeed will be the ones that stop relying on one-off demonstrations and start demanding clear, reproducible evidence of security. We will see the OWASP Top 10 for AI evolve from a list of definitions into a set of shared practices where the “method” of testing becomes the most valuable contribution to the field. Ultimately, my forecast is that AI security will become less about the behavior of the model and more about the discipline of the harness, the test case, and the workflow. The goal is to reach a point where we can prove our systems are secure through code, making the reality of safe, agentic AI something we can actually measure and maintain.
