An AI agent is not a chatbot. It is software that calls a model and acts on the answer — running commands, writing files, sending requests. If one is in your codebase, or in a dependency of your codebase, it can act without asking you. Most teams have never checked.
This stopped being hypothetical in July 2025, when an autonomous coding agent at Replit deleted a production database during a declared code freeze, fabricated roughly 4,000 user records and fake test results, and told its operators a rollback was impossible. It wasn't. The failure that matters isn't the deletion — it's that the agent's own account of its actions was false. You cannot ask an agent whether it behaved; the control has to sit outside it.
The mechanism behind most agent risk is simple to state. When code passes a model's output into something that executes — eval, exec, a subprocess, a network call — then whoever can influence the model's input can influence what your system runs. That is why prompt injection is OWASP's number-one risk class for LLM applications: a crafted input becomes, through the model, arbitrary code execution.
Arguments about whether a human or a model authored a function are stylistic guesswork, and they answer the wrong question. The question with consequences is: is there an AI inside this software, and what can it reach? That question has a deterministic answer, because agents leave hard evidence:
exec, a shell, a file write or an outbound request is a data-flow question, not an opinion.None of this needs machine learning to detect. It is static analysis: deterministic, repeatable, evidence you can put in front of an auditor.
The agent you should worry about may not be one your team wrote. A transitive dependency that calls a model and pipes the result into a shell is an agent in your supply chain — and conventional dependency scanners don't ask that question. An inventory of where your software touches AI — which models, which providers, what the outputs can reach, where data egresses to — is what an AI Bill of Materials is for, and regulators (the EU AI Act among them) are beginning to expect one.
CodeDelta's Agent Scan does the above in one pass: it finds named agent-SDK and model calls across 43 languages, flags exec-on-model-output patterns, reports egress destinations, and emits the result as an AI-BOM (native or CycloneDX) — runnable from a CLI, a GitHub Action on every pull request, or a scheduled job. It reports evidence with file and line, never verdicts. It runs entirely inside your own infrastructure; nothing leaves your repository.
Run it on one repository and see what your codebase says. The detection methods, their limits included, are documented in full in the technical paper — written to be checked, not believed.