Name: So you think AI writes secure code?
Start: 2026-11-06T13:15:00-0800
End: 2026-11-06T14:00:00-0800

Friday November 6, 2026 1:15pm - 2:00pm PST

Software development is becoming AI-assisted at every stage — design, coding, testing, bug fixing — and AI agents are increasingly doing it all. But do AI coding assistants actually write secure code by default? Most of the conversation around AI and security focuses on AI finding vulnerabilities. Far less attention goes to how state-of-the-art coding agents behave when they're the ones writing the software in the first place.

We built an automated harness to answer this directly — generating and evaluating over 2,500 code samples across multiple languages, models, and coding tasks, then scoring them with SAST tooling for introduced vulnerabilities. We tested vanilla generation against several security-steering approaches, from a single-line instruction file to a full set of layered security skills, to see which techniques move the needle, and at what cost.

In this talk, we'll walk through the harness architecture, share our full results — including where steering helped, where it hurt, and why — and lay out a practical framework for guiding coding agents toward secure defaults without paying an unsustainable token or performance tax. Attendees will walk away with a reusable methodology for evaluating their own AI coding assistants, and concrete, evidence-backed steering techniques they can apply immediately.

Key Takeaways
- A reusable methodology for benchmarking any coding assistant or model for security regressions before rolling it out to developers
- Evidence on which security-steering techniques actually reduce vulnerabilities, and by how much
- An understanding of the token-cost and latency tradeoffs of different steering approaches
- A practical framework for shifting security left into the AI-assisted SDLC

Speakers

Shruti Datta Gupta

Product Security Engineer, Adobe

Shruti Datta Gupta is a Product Security Engineer at Adobe where she works in the Security AI & Data Engineering team. Her current role involves building AI-powered tools to automate security processes and reduce engineering toil. She is passionate about applying AI to solve cool... Read More →

Joseph Seasly

Security AI & Data Engineer, Adobe

Joseph does Security AI and Data Engineering at Adobe. In his former life, he spent 13 years in the U.S. Intelligence Community working in a variety of agencies, technical roles, and missions.
linkedin.com/in/josephs1000
... Read More →

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

OWASP Global AppSec USA 2026

Shruti Datta Gupta

Joseph Seasly

Get help with the event

OWASP Global AppSec USA 2026

Shruti Datta Gupta

Joseph Seasly

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event