Evaluate an AI coding assistant on four things: where your code and prompts go, what the tool is allowed to do on your machine, how you can audit its activity, and how it behaves on your own code. A demo on a toy project tells you almost nothing about any of them.
Where does your data go?
Start with a data flow diagram from the vendor, then check it against reality. Which of your files, prompts and telemetry leave the machine? Where are they processed and stored, for how long, and are they used for training? Which subprocessors, including the model provider, touch them? Get the answers in contract language, not a marketing page, and verify what you can by watching network traffic during a trial.
Also check how the product treats files it should not read. Does it respect ignore files for secrets and environment files? A constructed test: place a fake key in an ignored file, ask the assistant a question that would tempt it to read the file, and see what leaves the machine.
What can it do on a developer's laptop?
Modern assistants do more than suggest text. They run shell commands, edit many files, call tools and browse. OWASP names excessive agency as a core risk for LLM systems: too much functionality, permission or autonomy. For each capability ask whether it can be switched off, whether it needs approval, and whether admins can enforce that setting centrally rather than trusting each developer.
Check identity too. Does the agent run with the developer's full credentials? Can you give it narrower, short-lived access?
How good and how safe is the output?
Run it on your own repositories with your own conventions. Give it tasks that touch authentication, input handling and dependencies, and review what it writes using your normal secure review. Measure rather than guess: how many suggestions pass your static analysis and dependency checks on the first try?
Watch for invented package names. If it suggests a dependency that does not exist, an attacker may register that name. Any new package it proposes needs verification.
NIST's SP 800-218A extends the Secure Software Development Framework to generative AI development, which gives you vocabulary for asking vendors how they secure their own models and pipelines.
Can you audit it afterward?
If something goes wrong you need logs: which prompts, which files, which commands, which user. Check whether logs are exportable to your own systems and how long they are kept. Ask what the vendor does about a security vulnerability in the tool itself, and how fast they disclose and patch.
How should a pilot be run?
Pick two or three developers on different codebases, including one with sensitive code, and give them a fixed task list for two weeks. Collect three kinds of data: findings from your scanners on assistant-assisted changes, the developers' own notes on where it helped or misled them, and security observations such as unexpected network calls or file reads.
Set exit criteria before you start. For example: no secret leaves the machine in the planted-secret test, admins can enforce command approval centrally, and logs export to your systems. If a criterion fails, the vendor gets a chance to fix it, but you do not roll out. Writing the criteria first stops enthusiasm from overruling the findings.
How to check or apply this
- Get the data flow, retention, training and subprocessor terms in writing.
- Test with a planted fake secret in an ignored file and watch the traffic.
- List every action the tool can take and decide which need approval.
- Confirm admins can enforce settings centrally.
- Run it on real code and measure findings from your scanners.
- Verify every dependency it suggests.
- Check audit log export and the vendor's vulnerability disclosure process.
- Pilot with a small team before a company-wide rollout.
Safeguard's IDE extensions and MCP server let scanning and guardrails sit in the same workflow, so assistant output gets checked as it is written.
Quick check
Is a vendor's SOC 2 report enough?
It tells you about the vendor's own controls. It does not answer what your data does inside the product or what the agent can do on your machines.
Should we ban assistants that run commands?
Not necessarily. Require approval for risky commands and enforce it centrally.
Sources
Last reviewed: 18 October 2026.
