Orca Security, a leader in cloud and AI security, today announced new capabilities to help organizations discover and secure AI-generated applications and autonomous agents across their cloud environments. The expansion builds on Orca’s AI Security offering, enabling security teams to uncover previously unknown AI applications, assess the risks associated with autonomous agents, and gain deeper visibility into AI-generated code.

AI is fundamentally changing who builds software and how it reaches production. Employees across business functions are creating applications using AI-powered tools, while developers increasingly rely on autonomous agents to write code and execute tasks. Yet many of these applications and agents operate outside traditional security processes, creating new blind spots.

“AI has turned everyone into a builder, but security teams are often the last to know what’s been created,” said Gil Geron, CEO and Co-Founder of Orca Security. “An employee can deploy an application over the weekend, while an autonomous agent can access sensitive data and take actions across cloud environments. Organizations need to understand not just what exists, but what it can access and where it creates risk. We’re bringing that context to the entire AI development ecosystem so companies can keep innovating without losing control.”

Uncovering Shadow AI Applications Through Digital Fingerprints

As employees increasingly use AI development platforms such as Lovable, Replit, and Bolt to create applications outside traditional engineering workflows, security teams often lack visibility into what has been deployed, where it runs, or what company data it can access. Traditional discovery approaches depend on knowing which platforms, applications, or repositories to monitor, leaving unknown AI-generated applications undetected.

Orca’s expanded AI AppGen Security capabilities address this challenge by identifying digital fingerprints that AI application builders leave behind across cloud infrastructure, DNS records, workloads, code repositories, and cloud identities. Using its patented agentless SideScanning technology and unified data model, Orca connects these signals to uncover previously unknown AI services without requiring additional agents, vendor integrations, or employee registration.

New capabilities allow users to:

  • Discover shadow AI applications through service fingerprints: Automatically detect digital fingerprints left behind by AI application builders such as Lovable, v0, Replit, Base44, and Bolt, alongside hosting and data services including Vercel, Netlify, and Supabase. Orca identifies evidence such as DNS records pointing to builder infrastructure, installed packages, file markers, AI builder commit identities, and cloud permissions, revealing services that security teams may not know are in use.

  • Connect fingerprints to business risk: Correlate discovered services with cloud identities, IAM permissions, and accessible resources to help security teams understand which AI-generated applications may have access to sensitive company data. Findings are presented through a dedicated Service Fingerprints view, asset-level details, and an AI AppGen dashboard, providing the evidence behind each discovery.

  • Expand security coverage across AI development platforms: Turn discovered services into actionable security coverage through supported integrations and posture assessments, including checks for insecure configurations such as disabled row-level security in Supabase projects. Orca is also extending AI AppGen Security support to Base44, OpenAI, and Vercel.

“Many organizations still struggle to discover what’s been built and where it runs. Now that building is no longer confined to engineering, discovery has to start from what these AI-generated apps leave behind in the environment, not from the builder declaring anything,” said Grace Trinidad, Research Director, IDC.

Securing Autonomous AI Agents and AI-Generated Code

Beyond AI-generated applications, autonomous agents introduce a new category of security risk. Unlike traditional AI models, agents can execute commands, access sensitive information, and interact with enterprise systems using the credentials and permissions available to them. A single overprivileged agent or insecure connection can create a path to sensitive data or critical infrastructure.

Orca’s expanded AI agent security posture capabilities provide visibility into cloud-managed and self-hosted agents, including coding agents operating on cloud infrastructure. By incorporating agents into its unified data model and existing cloud security workflows, Orca enables organizations to:

  • Discover and inventory AI agents: Automatically identify cloud-managed and self-hosted agents, including coding agents such as Claude Code, Codex, and Gemini CLI running on cloud workloads. A new Agents tab in Orca’s AI Bill of Materials (AIBOM) provides a centralized inventory alongside AI models, packages, and MCP servers, with filtering by cloud, account, and framework.

  • Map agent relationships and access: Connect agents to the AI models they use, MCP servers and tools they interact with, cloud identities they operate under, and data stores they can access. This context helps security teams understand an agent’s potential blast radius and identify paths to sensitive data.

  • Detect and prioritize agent-specific risks: Identify agents with excessive permissions, disabled approval controls, exposed credentials in MCP configurations, insecure HTTP connections, or access to destructive tools. Findings are incorporated into Orca’s dynamic risk scoring and attack path analysis to prioritize the most consequential exposures and provide actionable remediation guidance.

  • Track and secure AI-generated code: Attribute code to the coding agents and AI models that produced it, helping organizations understand the proportion of AI-generated code across repositories and identify which agents and models contribute the most security risk. Through Orca’s AI Skills Hub, developers can also integrate security requirements, application security scanning, and remediation directly into coding agents before code is committed.

These capabilities extend Orca’s existing cloud security workflows to AI agents, enabling organizations to assess agent-related risks alongside vulnerabilities, misconfigurations, identities, and sensitive data across their environments.

Learn More

About Orca Security Orca Security delivers security for the companies that build. As cloud, applications, AI and app generation expand the attack surface, Orca transforms security risk into the context teams need to act. The Orca Platform provides complete visibility across cloud, AI, and application environments, correlates risk across every layer, and prioritizes the exposures that matter most so organizations can remediate faster and innovate with confidence. Trusted by hundreds of organizations, including SAP, Autodesk, Gannett, Lemonade, and Digital Turbine, Orca is backed by leading investors including Temasek, CapitalG, ICONIQ Capital, and Redpoint Ventures. Learn more at orca.security. Connect your first account in minutes: https://orca.security or book a personalized demo.

Media gallery

About The Author
Business Wire