Apiiro launches Guardian Agent to rewrite developer prompts and curb insecure AI-generated code

Apiiro unveiled a new agent designed to intercept and modify developer instructions so that downstream AI coding assistants produce code that aligns with an organization’s security and compliance rules. The technology operates at the point of prompt creation, integrating into developer environments — IDEs and command-line interfaces — to alter prompts before they reach code-generation models. Apiiro couples prompt rewriting with static and dynamic knowledge of a customer’s software topology, using a software graph that maps dependencies and architectural relationships to inform safer output. The company positions this approach as a departure from conventional application security practices that focus on finding and remediating vulnerabilities after code is committed. That shift aims to reduce the volume of insecure code entering the codebase at source, especially as teams adopt AI coding tools that accelerate output and expand attack surface. Apiiro cites internal metrics indicating code volume can increase roughly fourfold with AI coding assistants, and that the effective attack surface can multiply about six times as APIs and duplicated components proliferate; these figures underpin the urgency behind preventive measures. By intervening at prompt time, the agent intends to lower the incidence of insecure patterns and misused libraries before they become technical debt or incident vectors. Operationally, embedding the guard in development workflows seeks to keep developer velocity intact while steering generated code toward vetted patterns and sanctioned dependencies. For organizations, this means rebalancing security investment: less effort chasing defects in CI/CD and more focus on embedding policy into the authoring phase. The approach raises questions about integration fidelity — how accurately policy-aware transformations preserve developer intent — and about coverage of diverse coding contexts and languages. It also changes the attacker calculus: vulnerabilities introduced inadvertently by generated code may decline, but defenders must still monitor novel combinations of components that AI can create. Longer term, if widely adopted, prompt-level sanitation could become a standard control in DevSecOps toolchains and influence how coding assistants expose interfaces. Apiiro has opened the capability in a private preview, signaling further productization and validation with early customers before broader release.