Research area · Software development Agentic
When coding agents co-author code: Verifiably securing code and the toolchain
Coding agents write code, run commands in the terminal, and integrate MCP servers and skills. The attack surface thus extends from the generated code through the harness to extensions and pipelines. We examine where AI-assisted code analysis demonstrably helps and where it becomes vulnerable itself, and translate this into a Secure SDLC in which the language model advises rather than steers.
- Coding agents & harness
- Slopsquatting
- AI SAST
- Exploit validation
- DAST with a bounded LLM
- Secure SDLC
- CI/CD pipeline security
- Deep Dives
- 8
- Whitepapers
- 5
- Solutions
- 2
From assistant to agent: the toolchain becomes the attack surface
AI now generates a large share of new code — Google cites 75% — and this code measurably introduces vulnerabilities more often: according to Veracode, 45% of AI samples fail the security test. At the same time, the assistant that suggests is becoming an agent that installs in the terminal, calls MCP servers, and loads skills. Along the way, language models also invent package names that do not exist and that attackers can register; since 2025, this has been called slopsquatting.
October 29, 2026, showed how vulnerable the toolchain is: a tampered version of the Claude Code extension with an SSH backdoor was distributed via the marketplace of the code editor Cursor — under the genuine identifier anthropic.claude-code. Our analysis of October 31, 2026, sets out checks and measures. Extensions run with the permissions of the logged-in user and reach source code, credentials, and terminals; this supply chain on developer machines is rarely controlled as strictly as servers or build pipelines.
On the analysis side, finding vulnerabilities is becoming a commodity: Google Big Sleep reported twenty real zero-days in 2025, and in August 2025, the finalists of the DARPA AI Cyber Challenge found 86% of the embedded vulnerabilities fully autonomously. On truly unseen zero-days, however, even frontier models still fail, and naive LLM classification without context is barely better than a coin flip. AI complements the testing layers; it does not replace them — VamiAppSec and VamiDAST work according to this principle.
Open questions in practice
- 01
How do you review code written by AI assistants and coding agents?
Our approach
Like human code — with review, SAST, tests, and dependency checks — but with a focus on the classes in which assistant-generated code predictably fails: authorization, tenant isolation, error handling. Code owners receive a guide for this. Agent and prompt risks in the repository are checked as well, such as rule files with invisible characters that humans do not see in review but that the model follows.
- 02
Can a language model replace rule-based SAST?
Our approach
No. Rule-based SAST remains the reproducible baseline hygiene on every commit and the only layer fit to act as a gate in the build. We use AI SAST with semantic reasoning in a targeted way on high-value repositories, for example against broken authorization and flaws in business logic. AI findings get an audit trail and human spot checks, because LLM judgments vary between runs.
- 03
How does a code finding become a reliable priority?
Our approach
Through a chain of proof: a rule or a model flags a location, then reachability, actual exposure, and exploitability are checked on the running system. What sits behind the path decides the order of remediation. That is why we agree on SLAs by exploitability rather than by CVSS alone and hand confirmed paths over to the code owners with reproduction steps.
- 04
How much language model can a dynamic security test tolerate?
Our approach
As little as necessary, and never at the wheel. In VamiDAST, a deterministic engine controls every scan; an LLM advises only at exactly three bounded points, and without an LLM, the deterministic detectors keep working. Every finding is backed by the payload and response evidence; production systems are tested only in passive or safe mode and only with authorization.
Key takeaways
- 01
The harness gets attacked, not the model
A coding agent consists of the model and the harness, from rule files through the terminal and MCP servers to skills, secrets, and the network. Documented attacks almost always hit this harness; the IDEsaster research series found more than 30 vulnerabilities with 24 CVEs in AI IDEs. Where vendors made fixes, they did so not in the model but in the harness.
Source: Slopsquatting & coding agents
- 02
Whoever compromises the build hits every shipped artifact
CI/CD pipelines concentrate permissions on repositories, package registries, and cloud environments. With Poisoned Pipeline Execution, access to the source code system is enough to manipulate the build. Effective measures are isolated runners without secrets for unreviewed code, CI configurations from protected branches, and short-lived OIDC credentials instead of static secrets.
Source: CI/CD Pipeline Security
- 03
Evidence backs LLM triage — but the AI analyst becomes a target itself
Behind a deterministic scanner, an LLM filter consistently reduces false alarms, by 88.6% on the OWASP Benchmark with a 3.1% loss in recall. At the same time, the model processes comments, READMEs, and issues as input: adversarial comments fool LLM detectors in over 90% of cases. Anyone using AI in code analysis thus turns it into an attack surface itself.
Source: AI SAST
- 04
Delivery timing determines the impact of SAST
At Meta, the fix rate of nightly batch scans was close to zero. When the same analysis moved into the code review of the diff as a comment, it rose to over 70% — with the same engine and the same false-positive rate. Google only lets analyses into review whose effective false-positive rate stays below 10%. Findings have an effect where developers already work.
Source: SAST
How we work
We consistently separate what can be checked deterministically, where a language model advises, and where humans decide — from the coding agent's harness through the pull request to the running application.
Harness analysis for coding agents
Capture rule files, inputs, terminal, MCP servers, skills, package managers, secrets, repository, and network as trust relationships and secure them outside the model.
Three layers of code analysis
Rule-based SAST on every commit, AI SAST with semantic reasoning on high-value repositories, frontier model analysis risk-based and periodic.
Exploit validation
From finding through reachability and exposure to exploitability: findings are confirmed on the running system before they set priorities.
DAST with a tightly bounded LLM
VamiDAST: a deterministic engine, with an LLM advising at exactly three bounded points; testing behind the login, BOLA/IDOR with a second identity, every finding with response evidence.
Pipeline hardening
OWASP Top 10 CI/CD Security Risks as the assessment grid: isolated runners without secrets for unreviewed code, short-lived OIDC credentials, signed artifacts with provenance per SLSA.
Standards and security champions
OWASP ASVS 5.0, CWE Top 25, and NIST SSDF as the yardstick, OWASP SAMM for maturity; security champions anchor security knowledge in every development team.
How to get started
- 1Inventory the toolchainCapture coding agents, extensions, MCP servers, package sources, and pipelines, and classify repositories by exposure and data class.
- 2Define layers and gatesDetermine for each repository which analysis runs at which cadence; quality gates in GitLab, GitHub, or Azure DevOps block critical findings.
- 3Substantiate findings and provide evidenceConfirm exploitability on the system, hand fixes over to the code owners, and produce evidence per release for the CRA, NIS2, and customer audits.
Deep dives, whitepapers, and analyses
Deep Dives 8
Whitepapers 5
Slopsquatting & Coding-Agenten für CISOs — securing the AI software supply chain
AI-Powered Security in the CI/CD Pipeline
CI/CD Pipeline Security: How Attackers Take Over Your Pipeline — and How You Take It Back
OWASP Top 10 CI/CD Security Risks — Practical Guide with Compliance Crosswalk
Secure Coding in the AI Era: The CWE Top 25 (2025) and Secure-by-DesignFrom research area to implementation
Related research areas
Coding agents on your team — is the toolchain secured?
We review agent permissions, extensions, pipeline gates, and your code analysis, and show where AI-assisted testing gives you the greatest leverage — with traceable evidence.