Droids with Live System Access

The core bottleneck is no longer whether an AI agent can write code, it is whether a company will trust that agent with the keys to live systems. Factory’s Droids move past autocomplete into repo edits, terminal commands, browser QA, and security workflows, which means a bad action can delete data, leak secrets, or ship broken changes instead of just suggesting bad code. That pushes the product toward approval gates, scoped credentials, and auditable execution as much as raw model quality.

• This risk scales with tool authority. OWASP treats prompt injection as a top LLM risk, especially when models can call tools or read untrusted inputs. In Factory’s case, long running Missions that touch repos, terminals, and cloud systems widen the blast radius from one bad answer to a chain of bad actions.
  1 sacra 4 owasp
• The category is already responding by wrapping autonomy in control systems. Factory has added Droid Shield secret detection, STRIDE based security analysis, and automated PR review. OpenAI’s Codex Security similarly works by scanning repos, validating issues in isolation, and proposing patches for review instead of acting directly on production systems.
  3 openai 5 openai
• A new control layer is forming around agent identity and permissions. SailPoint’s Agent Identity Security is built to discover agents, assign ownership, govern their access, and prevent over permissioning. That matters because enterprise buyers will increasingly treat Droids less like software seats and more like privileged machine employees.
  6 sailpoint 7 sailpoint 8 sailpoint

The next phase of agentic software will be won by products that can prove safe delegation, not just successful task completion. As Droids take on bigger jobs like migrations, incident response, and remediation, the market will reward vendors that combine autonomy with narrow permissions, review checkpoints, and clear audit trails across every action.