AI coding agents like Kiro and Claude Code generate features, tests, and code refactors from natural-language prompts, with a single agent able to open dozens of pull requests (PRs) across repositories in an afternoon. These agents optimize for task completion at machine speed without understanding organizational risk, and through protocols like the Model Context Protocol (MCP), they can call APIs, query databases, and modify infrastructure beyond the integrated development environment (IDE). An application security (AppSec) control framework for AI coding agents is organized into two pillars: author-time controls shape what the agent produces in the IDE, while build-time controls verify and gate what reaches production. The framework is tool-agnostic and cloud-agnostic, using AWS services—Kiro in the IDE and AWS CodePipeline in the build—as a running example. Risks are ordered by severity, with R001 being prompt and context injection, the top risk in the OWASP Top 10 for LLM Applications. Agents reading untrusted content like issue descriptions, web pages, MCP responses, and README files can be redirected to disclose secrets, open unauthorized PRs, or invoke tools without consent. Treatment includes treating non-developer input as untrusted, keeping the orchestrating agent separate from one exposed to untrusted content with read-only, least-privilege access, requiring human approval for irreversible actions, and using version-control steering files. R002 covers inadvertent data disclosure and overly permissive configurations, where generated code