Developers use AI coding assistants every day. But no one tracks what the agents wrote, whether it was reviewed, or where it ended up in production. For a security team, that is a gap in the one record that matters: what is actually running.
The scale of AI-written code
- 90% of developers now use AI at work, spending a median of two hours a day with AI coding tools (DORA 2025).
- More than 1 million pull requests were authored by GitHub Copilot's coding agent in its first five months (GitHub Octoverse 2025).
- 19% slower: experienced developers completed tasks more slowly with AI on complex, unfamiliar codebases, the opposite of what they expected (METR 2025).
More code, from more authors, many of whom never learned secure coding. The risk comes back to security.
What AI code traceability means
AI code traceability answers three questions with facts rather than guesses:
- Which code did an AI agent write, and in which tool?
- What was built from it?
- Where does it run in production now?
A pull request label or a commit message can tell you an agent was involved. It can't tell you what ended up in the artifact you shipped, or where that artifact is running.
Where the facts come from
In the developer workspace. The workspace sensor observes AI coding tool activity (Claude Code, Cursor, GitHub Copilot, Codex and others) at the OS level, with no IDE plugins and no workflow changes. It deploys zero-touch through your existing MDM and adds context about how code was written.
At build time. The build sensor adds a small, signed record to every artifact as it's built, saying what it is, where it came from and what's inside. The build is the source of truth, not self-reported metadata.
In production. The record travels with the artifact into production and reports where it is. It all connects in one data plane, so you can follow agent-written code from the developer workspace through CI/CD to the services that run it.
Why it matters for security
We don't use AI to secure AI. Every build is checked against your policy regardless of who or what wrote the code, and every answer traces back to what was actually built and what actually runs.
AI code traceability feeds the three questions every CISO has to answer:
- Can this ship? Keep bad code out of production.
- Are we exposed? Know where you're exposed the moment something changes.
- Can you prove it? Evidence whenever and whoever needs it, automatically.