Snyk CTO: AI Security is Mission-Critical

Manoj Nair, Snyk's Chief Innovation Officer and CTO, recently addressed the critical need for security in the age of AI at the AI Engineer World's Fair. In his presentation, titled "Through the AI Fog: The Architectural Decision Agentic Security Depends On," Nair highlighted the evolving threat landscape and the challenges organizations face as they increasingly rely on AI for software development.

The AI Security Imperative

Nair emphasized that security is not an afterthought but a fundamental requirement for building trusted AI systems. He pointed out that last year's AI Engineer conference highlighted a gap in security discussions, underscoring the need for dedicated tracks like the one he was presenting. The ultimate goal, he stated, is to build truly safe autonomous software at scale, a feat that requires integrating security from the ground up.

Three Core Problems in AI Security

Drawing on data from Snyk's 5,000+ enterprise customers, Nair identified three primary problems defining AI security in 2026:

• Automated AI Attacks: Nair warned that AI-speed threats are becoming a reality, capable of chaining low-severity vulnerabilities to create critical exploits. He noted that attackers can now bypass traditional application security measures by automating attacks at an unprecedented pace.
• Untrusted Agentic Development: The quality of AI-generated code is a concern, with Nair stating it's often worse than human-generated code. Furthermore, the development environment itself is vulnerable, with skills and MCP servers susceptible to poisoning and malware injection. The behavior of agents, such as creating unauthorized copies of sensitive data, also poses significant risks.
• Ungoverned AI Applications: Organizations cannot govern what they don't know exists. With the rise of AI agents and components, the risk surface expands. Nair stressed the importance of understanding the full landscape of AI usage and having independent data verification to assess and control risks.

Data-Driven Insights and Concerns

Nair presented stark data, revealing that over the past year, customer backlogs have increased by 108%, indicating that issue growth is outpacing remediation efforts. He cited a Five Eyes alliance advisory stating that AI will bypass cybersecurity systems in months, not years, emphasizing the urgency of addressing these challenges. Benchmarking data showed that nearly 50% of LLM-only vulnerability reports appeared in identical scans, highlighting the probabilistic nature of AI security and the potential for missed vulnerabilities. He also noted that some leading frontier models performed poorly in PI extraction tests, while open models showed better decision override capabilities.

Snyk's Solutions for AI Security

Snyk is addressing these challenges with a multi-pronged approach:

• Studio + Remediation Agent: Designed to prevent new issues from entering the agentic loop and to address automated attacks.
• Agentic Development Security: Focusing on the untrusted agentic development environment, including output, environment, and agent behavior.
• AI Security Posture Management: Aimed at governing AI applications by providing visibility and control in real-time.

Nair concluded by emphasizing Snyk's commitment to empowering AI security engineers with the tools and knowledge they need to build trusted, self-improving AI systems.