BlueFlag Security expands AI agent governance for unapproved coding tools
The startup adds features to track, audit, and automatically fix risks posed by autonomous agents running on developer laptops and within code repositories.
BlueFlag Security Inc. has expanded its developer risk platform to govern artificial intelligence agents that lack formal approval from security teams. This update specifically targets coding assistants that operate outside of central code repositories, including those running locally on engineers' personal devices. The new capabilities also include automated tools designed to remediate some of the risks identified by the system.
Raj Mallempati, BlueFlag's co-founder and chief executive, described these autonomous agents as "the most powerful and least governed identity in the development environment." While the company plans to begin actively interrupting attack paths formed by these agents early next year, it currently reports them for visibility. The platform detects agents by analyzing activity in code repositories through commits and pull requests, allowing security teams to trace any agent back to its developer owner and repository context.
To address agents running on local machines which are harder to spot, BlueFlag reads data from endpoint detection and response products such as those from CrowdStrike Holdings Inc. and SentinelOne Inc., ensuring no new software needs installation on the devices. The system flags pull requests approved by AI agents, commits written entirely by an agent without human intervention, and pipeline runs that deployed code with no person signing off. Organizations can now require a human review before any merge or deployment and document where humans were involved in decision-making for each release.
The platform also includes an inventory of AI models inside applications, recording providers and frameworks while scoring them against the Open Worldwide Application Security Project's Top 10 for Agentic Applications. Additionally, BlueFlag measures AI spending by linking tokens and dollars burned to specific commits and accepted code, highlighting areas where costs rise without corresponding new output or identifying paid seats that remain idle.
Remediation is handled through two new tools: AccessGuard targets identity issues like overpermissioned accounts and stale credentials, while DriftGuard corrects misconfigured repositories and pipelines, such as missing branch protections that drift over time. Fixes can be applied manually via written instructions or automatically with one click, with automated changes capable of being rolled back if needed.
Auto parts supplier Marelli Holdings Co. Ltd. is a customer for the platform. Kristie Pfosi, its global chief information security officer, noted that agentic AI expanded unknowns within her company's development environment "overnight." She added, "Within the first week BlueFlag showed us which AI agents were working in our repositories, which developers they worked with, and where the gaps were in how they were approved, scoped and reviewed. Those are findings we can act on the same day."
The feature launch follows a research report titled "The State of Developer Risk 2026." published by BlueFlag earlier that week. Data for the report was collected from metadata on tens of thousands of identities and access tokens at a subset of enterprise customers in September, revealing that unapproved coding agents appeared in 83% of measured organizations. More than two-thirds of identities under which agents operate carry administrator rights, and autonomous agents merged code without human involvement in 22% of organizations.
The report highlighted persistent issues as well, noting that nonhuman identities accessing code repositories outnumber human developers eight to one, and 99% of access tokens are configured to never expire. The new features are generally available now, with the platform connecting through read-only application programming interfaces that can run in under five minutes. Automated fixes are applied only when a customer opts in.
BlueFlag launched in March 2024 with $11.5 million in seed funding led by Maverick Ventures and Ten Eleven Ventures. The company returned to raise a Series A this past March, bringing total funding to $28 million.
