by Madelaine Millar

Agentic AI coding tools are enormously powerful, and increasingly widely used. Unfortunately, the very things that make them so capable – like persistent memory, tool integration, and autonomous code execution – also create huge new surfaces vulnerable to attack. 

When Anania Gebregiorgis learned about this issue in the first semester of his master’s in Cybersecurity at Northeastern University in Arlington, it got the wheels turning in his head. When he was tasked with a research project in his second semester, he chose the topic and decided to take a crack at a solution.

“I realized how many known vulnerabilities are being created by agentic AI, because it isn’t actually assuring the quality of the code it writes,” Gebregiorgis said. “Apiiro found AI-generated code was introducing over 10,000 new security findings a month by mid-2025, that’s a tenfold increase in six months. That’s a very big issue, since developers are focused on getting the most work done in the shortest amount of time, not on whether the AI’s output is actually secure.” 

Tackling a multi-faceted risk landscape

The attacks Gebregiorgis focused on are fourfold. 

Prompt injection

Malicious inputs disguised as legitimate prompts work to get an agent to leak sensitive information, and have a success rate as high as 90%. For example, a prompt injection attack may begin by instructing an agent to “ignore previous instructions”.

Data poisoning

Rather than attacking the model itself, this method corrupts the external knowledge and memory that agents rely on. An attacker can slip a handful of crafted documents into an agent’s knowledge base to manipulate its answers to specific queries, or plant false information in an agent’s persistent memory files during one session that quietly shapes its behavior in every session after.

Insecure code generation

This vulnerability appears when agent-generated code contains design flaws. They can be the same kinds of errors as humans make or errors specific to AI; the fastest growing flaws are related to privilege escalation paths and architectural design flaws, the exact categories automated scanners struggle to catch.

Agent skills supply chain

These breaches occur when developers load skills into their agents that have been compromised by an attacker. When agents then run those skills, they do something other than what the user intends. 

Across all four attacks, Gebregiorgis realized that slowing down the coding and development process by removing AI from the process was not likely to happen. Instead, his solution needed to allow a human to oversee and intervene when necessary, without having to monitor an exponentially larger volume of work than was actually possible. And the solution could come from the same source as the problem: AI agents.

Developing the Parallel AI AppSec Architecture (PAAA)

The Parallel AI AppSec Architecture (PAAA) is Gebregiorgis’s research-based concept for a multi-agent security framework. It surrounds a primary coding agent, the Builder Agent, with a team of specialized security agents running concurrently at every step, rather than checking its work after the fact. Those include a Prompt Guard Agent monitoring every input for malicious instructions; a Code Security Agent analyzing each proposed code change for vulnerabilities before it’s written to disk; a Skill & Supply Chain Vetting Agent validating the integrity of new skills before they’re loaded in; and a Policy and Human Oversight Agent that acts as the final gate, automatically allowing low-risk actions while flagging anything high-risk for a developer’s approval.

“It’s enforcing a data plane and control plane separation,” Gebregiorgis explained. “It’s harder for an attacker to attack all different agents, giving it multiple layers of security. If that builder agent is vulnerable – if it is being attacked by a skill that it’s using, or if the prompts are injected by another by another external tool or website – we can sense that, because another agent is running alongside.” 

Gebregiorgis presented the theoretical framework for the PAAA at Northeastern in Arlington’s Student Research Showcase in April of 2026. He enjoyed the opportunity to get a range of expert feedback before investing heavily into building out the system, and to hear from coders in the industry thinking along similar lines.

“I got great feedback from professors, from AI researchers, and from actual people working in industry – people and companies that work on AI security,” he said. “It is a very big subject, and still a growing subject; we don’t know what we have ahead. But it got me excited to go through it with every other person.” 

He plans to work towards prototyping the PAAA over the summer.

The work continues, and so does the support

Gebregiorgis appreciates the support his Northeastern professors have provided, even on what is now a firmly independent project. 

“My professors give me good advice every time I reach out and ask for their thoughts,” Gebregiorgis said. “Dr. Hawthorne has been a very great help; since the beginning of my classes here. She asked me to think about what I want to focus on, and that’s how I began paving the way into AI security. And Dr. Jung reviewed the poster, and gave me advice on how to get started with the agents. These professors have been a very great help.” 

Gebregiorgis is quick to credit Northeastern’s Arlington campus itself for the freedom he’s had in shaping his own path. Between supportive professors, an engaged student community, and staff who make time for one-on-one guidance, he says the environment gave him room to think beyond the bounds of a standard research assignment.

“I don’t want to focus on just doing the research. I’m building the projects; I’m really focused on the technical aspects,” Gebregiorgis said. “At Northeastern in Arlington, you’re free to think without borders; that really aligned with my purpose and way of thought.”