As agentic coding becomes the norm and generates more code than humans can realistically review, Harness and Chainguard have launched products designed to make security part of the infrastructure supporting automated software development.
Harness, an AI Software Delivery Lifecycle vendor, launched its freshly acquired Cosmos software factory on October 8. Chainguard, a software supply chain security company, followed on October 14 with Workspaces and Checks, two products designed to secure AI-driven development.
Both Cosmos and Workspaces use isolated virtual machines to run coding agents. Cosmos coordinates multiple parallel agent runtimes, while Chainguard's Checks lets agents run tests and correct problems during development, without waiting for a traditional continuous integration (CI) pipeline.
Analysts said the vendor moves reflect the industry's continuing march toward greater autonomy in the SDLC and the struggle to do that securely.
"Agents are being treated as infrastructure to be operated," said Katie Norton, an analyst at IDC. "For many organizations, agentic development has moved from experiment to default, and I’m hearing about teams reducing human code review as agents push changes more directly. Security attention has followed."
Katie Norton
What hasn't followed is the adoption of controls. AI is producing more changes than review processes can absorb. "I think the industry is a bit over its skis," Norton said.
A July 2026 IDC DevSecOps and software supply chain security survey, found that 74.6% of 309 respondents agreed that AI coding assistants increase the risk of developers merging code without fully understanding the security implications, even when that code passes automated scans. Among organizations using AI coding assistants, only 28.0% require peer review of AI-assisted changes, and only 23.3% log or audit how those assistants are used.
That leaves a large gap in visibility and verification, Norton said. "Products that build isolation, audit trails and verifiable test results into the development process are aimed at closing that gap without adding more manual review."
Disposable VMs, network controls shore up safeguards
Both Cosmos and Chainguard Workspaces spin up ephemeral microVMs to give agents a separate, disposable execution environment. This isolation makes it less risky to run untrusted code, while microVMs offer a lighter infrastructure footprint than traditional long-running virtual machines.
"[The use of isolated VMs] ... treats an agent more like an untrusted CI runner than a developer with unrestricted access," said Suresh Gangula, DevOps engineer at Nike. "A disposable VM gives each task a separate execution boundary and reduces the blast radius if an agent, dependency or credential is compromised."
Developers and agents can unintentionally pull in untrusted code during development, including compromised packages and unsafe dependencies, Gangula said.
"Many CI runners hold long-lived secrets alongside the untrusted code they execute, which is why pipelines have become an attractive supply chain target," Norton said.
The inclusion of VMs becomes crucial as software factories begin to let agents execute code, access dependencies or interact with cloud and delivery systems, Gangula said. Mistakes happen in conventional software development, too, but in a software factory, they happen faster.
"A factory can run many agents in parallel, so one compromised dependency or over-permissioned agent can create a much larger blast radius than a single developer mistake," he said.
A factory can run many agents in parallel, so one compromised dependency or over-permissioned agent can create a much larger blast radius than a single developer mistake.
Suresh GangulaDevOps engineer
The VM functions as if the agent were running on a separate machine, providing an added level of security when compared to containers.
"Should an agent pick up an incorrect package or get duped by something in a repository, isolation ensures it does not affect others," said Chandrasekhar Katru, software engineer at Wells Fargo. "A container shares the kernel of the host, thus, a single breach and you find yourself on the host. A [VM] has its own kernel; this will act as the boundary between the untrusted code and the rest."
Beyond workload isolation, Chainguard Workspaces and Harness's downstream worker agents also offer network controls to limit where agents can send data.
"Even a contained agent can try to send source code or credentials somewhere," Norton said. "Chainguard keeps secrets out of the environment entirely and lets teams set egress as tightly as each task requires. For a narrow, repetitive agent loop that shouldn’t need the network at all, any outbound attempt is itself a signal that something has gone wrong, so the environment can be torn down and the task retried."
Continuous verification faces a test
In both Cosmos and Checks, agents can respond to failed tests and correct their work without human intervention. Checks specifically brings testing directly into the agent's development workflow, letting it receive results and make fixes without waiting in a traditional CI queue.
"You can think of it as a replacement for GitHub Actions," said Sam Katzen, director of product marketing at Chainguard, referring to Checks.
Replacing an established CI platform could prove difficult, however, Norton said.
"Pipelines carry years of organizational logic, and replacing one is a very different decision than swapping one scanner for another," Norton said. "Vendors have tried to sell more secure, opinionated pipelines before, and customers have generally wanted the security components without giving up the CI system they already run."
How autonomous are factories becoming?
Routine tasks such as fixing bugs, remediating vulnerabilities and implementing small feature requests could account for 60% to 80% of coding work, estimated Jyoti Bansal, co-founder and CEO of Harness. He projected that Cosmos could automate a substantial portion of software engineering tasks, with human intervention reserved for when it's needed.
"We probably can take care of, like, 40 to 50% of the software engineering tasks just autonomously," Bansal said.
Practitioners remain skeptical that agents can reliably handle the entire SDLC without human oversight.
"Agents work well for scoped tasks such as dependency updates, tests and smaller fixes, but fully autonomous ticket-to-production is still uncommon," said Gangula, citing wrong requirements, incomplete tests and high-risk production changes that still need human judgment and approval.
Katru was even more skeptical.
"I would not say an autonomous software factory has been established yet," said Katru. "The trick is getting the product reviewed and merged."
Ben Lutkevich is an award-winning writer for TechTarget's infrastructure group.
Katie Norton
