AI coding agents and your website: 7 questions to ask before they touch your live site
90% of software professionals now use AI, and coding agents can change a live site on their own. What went wrong at Replit, and seven questions to ask your developer.
Lunova
AI is now part of how most websites get built. Google’s DORA research puts AI adoption among software professionals at 90%, and the newest tools, AI coding agents, can run commands and change files on their own. That is mostly good news: agents are quick, tireless and happy to do the dull bits.
The risk is not the code they write. It is the access they are given. An agent that holds a developer’s keys can change your live site, your customer data or your payments setup, and it will do it at machine speed, without a second thought.
You do not need to understand the technology to manage that risk. You need to ask your developer seven questions, and know what a good answer sounds like. They are below.
Key takeaways
- AI is already in your website project. 84% of developers use or plan to use AI tools, so assume yours does.
- Developers do not fully trust it either. More developers distrust the accuracy of AI output (46%) than trust it (33%).
- The danger is access, not intelligence. In 2025 an AI agent deleted a company’s live database despite being told to make no changes.
- The fix is boring and effective. Limited permissions, a human approving every release, separate test and live data, and tested backups.
- You can check all of it with seven plain-English questions to your developer.
AI coding agents are now part of how websites get built
Google’s 2025 DORA report surveyed nearly 5,000 technology professionals and found AI adoption had reached 90%. The Stack Overflow 2025 Developer Survey tells the same story: 84% of developers are using or planning to use AI tools in their work.
The newer step is the agent: AI that does not just suggest code but runs commands, edits files and talks to other systems on a developer’s behalf. That is a different kind of tool. Autocomplete can only suggest. An agent can act.
And the people using these tools are cautious. In the same survey, 81% of developers said they have concerns about the security and privacy of data when it comes to AI agents.
AI speed is not the same as safe delivery
Agents feel fast. That feeling is not always reliable. In a controlled study by METR, 16 experienced developers took 19% longer on real tasks when they used AI tools, yet afterwards believed AI had sped them up by 20%.
To be fair to the tools, METR now says those early-2025 results no longer reflect current AI models, and its 2026 follow-up was too noisy to give a reliable figure either way. The lesson that survives is simpler: how fast a change was written tells you nothing about whether it was checked.
DORA puts it neatly. AI acts as “a mirror and a multiplier”: a team with good habits gets better, and a team with sloppy ones gets sloppy faster.
What happens when an AI agent has the keys to production
In July 2025, SaaStr founder Jason Lemkin was building an app with Replit’s AI agent. According to The Register, the agent deleted a production database, ignored an instruction to freeze the code, and invented data. The OECD logged it in its AI Incidents Monitor.
Nobody asked it to. Nobody approved it. It just had the access.
Look at what Replit announced in response. Automatic separation of development and production databases, to prevent this “categorically”. One-click restore of the whole project. Staging environments “in the works”. None of that is AI. It is the same release discipline good web teams have used for years, applied to a new kind of user.
AI agent security risks in plain English
In December 2025 OWASP, the non-profit behind the most widely used web security checklists, published its Top 10 for Agentic Applications. Three of the top risks translate directly to a website project:
- Agent goal hijack (ASI01). Instructions hidden in a web page, a document or a code comment can steer an agent into doing something else.
- Tool misuse (ASI02). An agent uses a tool it is allowed to use, such as a database command, in a way nobody intended.
- Identity and privilege abuse (ASI03). An agent borrows a person’s login or keys and ends up able to do far more than its task needs.
The UK government’s AI Cyber Security Code of Practice answers all three in principle. Permissions granted to an AI system should be “only provided as required for functionality”, there should be the capability for human oversight, and system and user actions should be logged. Least access, a human in the loop, and a record of what happened.
Not sure what can reach your own site today? In a free website audit we look at it together on a live screen-share and tell you what we would fix first.
7 questions to ask your web developer about AI coding agents
- Which AI tools work on our code, and what can they reach? You want a short, specific list, not “we use whatever is best”.
- Do AI agents have their own limited access? Agents should use their own credentials, scoped to the task, never a developer’s full login or a master key.
- Can anything reach our live site without a person approving it? The only good answer is no. Every release should need a human to say yes.
- Do we have a staging site, with test data kept apart from live data? Changes should be tried somewhere that is not your real shop, bookings or customer records.
- Are backups tested, and how fast can you restore? A backup that has never been restored is a hope, not a plan.
- Is every change reviewed and recorded? A person should read what the agent wrote, and there should be a log of who, or what, changed what and when.
- Do we own the code, hosting and domain accounts? If something goes wrong, you need to be able to see and recover your own site.
Good answers and red flags
| Question | A good answer | A red flag |
|---|---|---|
| AI tools and reach | A named list, with what each can access | “We use AI for everything” |
| Agent access | Separate, limited credentials per task | The agent uses the developer’s login |
| Approval to go live | A person approves every release | Changes deploy automatically |
| Staging and data | A staging site with separate test data | Testing happens on the live site |
| Backups | Tested restores, with a time to recover | “The host does backups” |
| Review and logs | Every change reviewed and logged | Nobody reads AI-written code |
| Ownership | Accounts in your name | Everything sits in the agency’s accounts |
AI coding agents are useful, with a badge and a supervisor
None of this is an argument against AI. Agents write tests nobody else wanted to write, untangle old code and get routine changes done in minutes. A team that uses them well can deliver more for the same budget.
The trick is to treat an agent like a very fast new contractor: give it a badge that opens only the doors it needs, and have someone sign off its work before it reaches your customers.
If you do one thing after reading this, ask your developer question 3 this week. Their answer will tell you most of what you need to know.
How Lunova Labs builds websites
Lunova Labs designs and builds websites, e-commerce stores and SaaS platforms. Your code, domains and hosting sit in accounts in your name, and handover includes documentation and the keys, so nothing is held hostage if you ever move on. Our care plans cover monitoring and updates after launch.
For more on keeping a site safe, read what 11,334 new WordPress vulnerabilities mean for your site, see how we moved a 68-page site to a new domain without losing SEO, or browse our recent work.
Ready when you are