Tips for developers to use agents to improve security

I don't know about you, but I spent the last week tightening up my security. Given the acceleration of exploits and reconnaissance in October, we should spend a bit more on safety.

First things first, CVE-2026-98432 is a critical vulnerability in the Linux kernel. It's unpatched in Ubuntu and RHEL, but patched in Debian, SUSE, Oracle Linux, Amazon Linux. If you can't patch yet, look up how to disable MPTCP.

AI has certainly accelerated things. So, you know all that productivity AI has yielded? We should pay some of that back to security.

But security outcomes can be hard to measure. What's the difference between fixing a medium vulnerability today vs. next week vs. next month? That's a tough one!

On the other hand, for high/critical vulnerabilities, it makes sense to clear those out at a faster cadence than you've done in the past.

Security tips for developers

☠️ Check your vulnerability scanners (code/SAST, packages, cloud/infrastructure, identity, secret scanning, pen testers, etc.)

☠️ Ask your agents to see if you're missing vuln scanning coverage in your repos and infrastructures. Tell it the security tooling you're aware of, and ask for both OSS and paid service recommendations.

☠️ Check your OS patches are up to date - servers and workstations.

☠️ Ask your agents to audit your CI/CD setup for security best practices, and look for linters and security scanners. There's a lot of stuff that can be done at the git forge / CI / CD layer. GitHub Dependabot, secret scanning like betterleaks, SAST like Semgrep, branch protection, container scanning, version pinning, dependency cooldowns, scanning your CI/CD itself like zizmor, etc.

☠️ Do an access review check - are there any identities/secrets you don't need? Particularly in the critical apps. And make sure you look at the underlying data sources.

☠️ Improve your identity hygiene. Set up 2FA, preferably stronger ones (not SMS). Set up SSO.

☠️ Check that your agent itself has safeguards. Block them reading secret files, audit their agent traces, think through the secrets/servers they could access if they run loose on your computer.

A mindset of gamifying security

Don't try to be a perfectionist. Don't try to do everything at once - ask the agent to audit the system at a high level, and pick one. Don't try to automate it - a manual one-off scan can reveal issues. Don't try to run it all by hand - ask your agent to install the scanner and run it. It's much faster than doing it by hand.

Pace yourself over time.

Personally, I treat it as a game. (It helps keep things fun, and burnout at bay.) You're hunting for high/critical vulnerabilities with a reasonable likelihood of exploit. If you can find one, tell your team and tell your manager - you're doing the team a service.

Reach out if you think I missed any low-hanging fruit; I'm sure I missed some.