AI Coding Security

Generated code brings a distinct risk profile. These are the ones that do not exist, or barely exist, when a person writes every line.

Hallucinated dependencies. Models sometimes import packages that do not exist. The security consequence is slopsquatting: attackers watch for commonly hallucinated names, register them, and wait. Verify that every new dependency is real, popular, and maintained before installing it — the install itself can execute code.

Secrets in prompts. Pasting a config file, a stack trace, or an environment file to get help sends those values to a third party. Redact before sharing, and rotate anything that escapes. This is the most common real-world leak in AI-assisted work, and it is entirely preventable.

Prompt injection in your codebase. An agent that reads files, issues, or web pages can encounter text written to manipulate it — a comment in a dependency, a crafted issue description. Content read by a tool is data, never instruction. The blast radius is whatever credentials the agent holds, which is the argument for scoping them tightly.

Plausible-but-wrong security code. Models produce authentication, crypto, and validation code that looks idiomatic and is subtly wrong: a comparison that is not constant-time, a JWT verified without checking the algorithm, a permission check on the wrong object. Security-relevant code needs review proportional to its consequence, not to its length.

Insecure defaults carried forward. Training data contains a great deal of tutorial code: permissive CORS, disabled TLS verification, string-concatenated SQL, secrets inline. These patterns reappear because they are common, not because they are correct.

Licence contamination. Generated code can closely reproduce training examples under licences incompatible with your project. It is a low-frequency, high-consequence risk and worth knowing your organisation's position on.

Over-broad agent permissions. Giving an agent a token that can do everything means a single confused or injected step can do everything. Scope to the task, prefer read-only where possible, and require confirmation for anything destructive or outward-facing.