Who approved that? The AI agent question security teams can’t skip 

In late October 2026, developers found that a routine update to a widely used desktop API client had changed their AI coding agents without asking. For security and compliance teams, the tool matters less than the question the incident raises: when something changes how your AI agents behave, who approved it? 

What happened in developers’ AI agents  

According to a GitHub issue filed Oct. 25, 2026, opening an existing install of the desktop app triggered an automatic upgrade. That upgrade installed the vendor’s plugins into two AI coding agents, Claude Code and Codex, without asking the user. The installer reportedly approved its own session-start hook, a setting that gives an agent standing instructions before the developer types a word. Those instructions pushed the agents toward the vendor’s tools for API lifecycle management. The developer also found a configured connection to a remote server that uses Model Context Protocol (MCP), the standard that lets AI assistants connect to outside tools, and one user reported that uninstalling left entries behind.  

Another developer reported the same automatic install after a later update. Others found entries in Cursor and GitHub Copilot, and one user said the app’s own uninstall option left the Copilot entry in place. On November 5, the vendor said it’s reverting the change while it redesigns the experience. Write-ups now include steps for removing the entries by hand. No report so far describes data collection. The coverage spans a GitHub issue thread, posts on X (Kai/@hqmank, Manthan Guptaa/@manthanguptaa ), a DEV Community write-up, Notebookcheck, and The New Stack. The facts are still emerging, but the pattern is clear enough to plan for. 

The risk: Agents you can’t control, audit, or predict 

AI coding agents read source code, call internal APIs, and act on credentials. Whoever sets their instructions shapes their behavior. When a tool changes those instructions without an explicit “yes” or an approval from the developer, three things break: 

• Control: The team no longer knows who decided what its agents do by default. 

• Auditability: If an agent follows hidden instructions and something goes wrong, nobody can show who approved them. Compliance reviews routinely ask that question, so this compromises audit-readiness. 

• Predictability: An agent acts on explicit instructions. When those change unknowingly, the team can’t say what the agent will do, and the same prompt can produce a different result than the one intended. 

Lost control, auditability, and predictability erode trust, and enterprises feel that first. Serious incidents can start this way. An integration arrives, a permission approves itself, and a connection outlives its purpose. No stolen password is required. Each step looks convenient, and the cost arrives later as an incident, an audit finding, or a customer who loses confidence and takes their business elsewhere. This results in a direct hit on revenue and credibility. 

Four controls that keep AI agents accountable 

Before an agent touches your code or credentials, you should be able to account for each of these controls: 

• Security: Protecting code, data, and credentials. 

• Control: Nothing changes in your environment without your approval. 

• Rightful access: Agents and tools reach only what they’re authorized to reach, for reasons you can defend. 

• Compliance: You can show who approved what and when, at any time. 

Any software that touches your agents becomes part of your attack surface. Together, these control protect customer experience and brand reputation from avoidable mistakes.

How SmartBear approaches governance in the AI era 

Every engineering organization now faces the same question: how do you protect the integrity of 10x more applications built at 10x speed? Speed without governance multiplies risk at the same rate it multiplies output. 

Application integrity gives teams continuous, measurable assurance that their software just works as intended, with the governance to operate at AI speed and scale. It asks whether the application delivers the intended business outcome in an environment influenced by AI. The SmartBear Application Integrity Core™ is the foundation for quality, governance, and trust across the software lifecycle. It brings together an AI execution layer,  made up of MCP tools, agentic workflows, and autonomous systems, with a system of record built on an API catalog and test repository. That gives teams one discoverable source of truth for applications and APIs. We embed governance  in the workflows and existing toolchain your teams already use. Our principle is simple: people decide what an agent can access, every change should be visible, and every action should be traceable. That holds at every level of autonomy, from human-led work to agents acting on their own. Teams adopt AI incrementally, on terms they set. 

Give agents only the access your people already have 

SmartBear Swagger® Studio delivers application integrity by keeping API definitions standardized, validated, and governed continuously during development, whether developers or AI coding tools write them. Its MCP server extends that governance to AI assistants. The server respects each user’s existing Swagger Studio permissions, and both organization-level and resource-level roles apply. In remote mode, users sign in with OAuth over HTTPS, their password never reaches the AI client, and the server stores no API data beyond a single request. For the Claude connector, an organization owner adds it, and every tool needs user approval before each use by default. 

Catch API problems before production 

SmartBear ReadyAPI delivers application integrity with integrated functional, security, and performance testing plus service virtualization that continuously validate API quality on-premises. This occurs across REST, SOAP, GraphQL, Kafka, and more, so teams can ship production-ready APIs at AI speed and scale. When AI speeds up how fast APIs change, repeatable tests give security and compliance teams something to verify before production. Teams can switch ReadyAPI’s AI features, including AI Test Generation, on or off, so teams adopt them on their own terms. 

Together, Swagger Studio defines and governs what an API should do, and ReadyAPI validates that it does what’s intended.  

Five questions to ask every vendor with AI agent integrations 

Auditability of AI agent activities is crucial, as SmartBear’s State of Software Quality and Testing 2026 report shows 47% of quality professionals have been unable to explain how AI contributed to a bug or production incident. Whichever vendor you choose, hold every tool that touches your agents to the same standard. Start with these questions when vetting vendor AI agent integrations: 

• Does it ask first? Installs, plugins, hooks, and connections need explicit opt-in, including during updates. 

• Is access scoped? Agents should get least privilege, through each user’s own identity and permissions you set. 

• Who approves startup instructions? A person should approve every hook that runs at session start, and no installer should approve its own hook. 

• Can you see and reverse everything? Look for a full audit trail and an uninstall that removes every change. 

• Can the vendor prove compliance? Ask for logs, certifications, and a clear account of how they handle incidents. 

Speed in API generation will keep rising. Choose partners that give you the controls to match it. Start a Swagger Studio trial or a ReadyAPI trial to see how each fits your governance requirements, or talk to our team.