AI-generated code carries a 2.74x higher vulnerability rate than human-written code (Source: Veracode, Cloud Security Alliance 2026). The standard hardening workflow is: scan every PR with a SAST tool (Semgrep or CodeQL), detect secrets with gitleaks, audit dependencies with npm audit or Snyk, pin all packages to exact versions, and wire all three checks as required CI/CD gates. For AI-specific threats, verify that every AI-suggested package actually exists in the public registry to defend against slopsquatting, and threat-model every AI-built feature that touches authentication, data storage, or user input.
- Approximately 45% of AI-generated code samples contain vulnerabilities mapped to the OWASP Top 10 (Source: Veracode, Cloud Security Alliance 2026).
- AI-generated code has a 2.74x higher vulnerability density than human-written code (Source: Veracode 2026).
- Slopsquatting: attackers register malicious packages using names that AI models hallucinate. Term coined by Seth Larson, Python Developer-in-Residence.
- Three CI/CD gates catch the highest-risk categories: SAST (code), SCA (dependencies), secret scanning (credentials).
- Semgrep: sub-second PR scanning with custom rules. CodeQL: deep semantic analysis. Snyk Code: AI-powered pattern matching.
- gitleaks: pre-commit secret detection in milliseconds. trufflehog: deep scanning with live secret verification.
- Dependency pinning + lockfiles + provenance attestation block both known-vulnerable and hallucinated packages.
- Prompt injection is the number-one risk in the OWASP Top 10 for LLM Applications 2025. Defense is five layers deep.
Why AI-Generated Code Is a Security Risk
Vibe coding accelerates development by 3x to 4x. But that velocity has a cost. Developers using AI coding assistants introduce security findings at 10x the rate of their peers because AI-generated code inherits the insecure patterns present in its training data (Source: Cloud Security Alliance, Veracode 2026).
The core problem is that AI models optimize for "does it work," not "is it safe." A model that generates a working Express.js endpoint will skip input validation, omit rate limiting, hardcode an API key, and use HTTP instead of HTTPS. The endpoint works. It also has four exploitable vulnerabilities.
In 2026, investigations of vibe-coded applications uncovered thousands of vulnerabilities including hardcoded secrets and exposed personally identifiable information (Source: Cloud Security Alliance 2026). This is not a theoretical risk. It is the measured reality of shipping AI-generated code without security gates.
AI-generated commits ship at 3-4x the rate of manually written code. Security findings accumulate at 10x the rate. If your security scanning runs slower than your AI-assisted development, you are accumulating exploitable debt faster than you can pay it down (Source: Cloud Security Alliance 2026).
The AI Code Risk Surface
Code Vulnerabilities
Injection flaws, missing input validation, hardcoded secrets, insecure defaults, broken access control. SAST scanners detect these.
Supply Chain
Vulnerable dependencies, outdated packages, hallucinated package names (slopsquatting), missing provenance. SCA and dependency audits detect these.
AI-Specific Threats
Prompt injection, excessive agency, system prompt leakage, sensitive information disclosure. OWASP Top 10 for LLM Applications 2025 maps these.
The 2026 industry consensus is to treat every block of AI-generated code as untrusted input. It must pass through automated static analysis, dependency scanning, and secret detection before reaching any branch (Source: Kusari.dev, Cloud Security Alliance 2026).
The Vulnerability Taxonomy
| Category | OWASP Mapping | What AI Gets Wrong | Detection |
|---|---|---|---|
| Broken Access Control | A01:2025 | Missing auth middleware, no row-level security, insecure API endpoints | CodeQL, Semgrep |
| Injection Flaws | A05:2025 | SQL injection, XSS, command injection from missing input validation | Semgrep, Snyk Code |
| Security Misconfiguration | A02:2025 | Debug mode enabled, CORS wildcard, verbose error messages in production | Semgrep custom rules |
| Cryptographic Failures | A03:2025 | Hardcoded API keys, weak hashing (MD5/SHA1), HTTP instead of HTTPS | gitleaks, trufflehog |
| SSRF | A10:2025 | Unvalidated URL inputs passed to server-side fetch calls | CodeQL data-flow analysis |
| Insecure Deserialization | A08:2021 | Unvalidated JSON parsing, unsafe eval of serialized data | Semgrep, manual review |
Why AI Reproduces These Patterns
AI models learn from public codebases. Public codebases contain millions of examples of insecure patterns: database queries built with string concatenation, API keys stored in configuration files committed to repositories, and endpoints that accept any input without validation. The model does not know these are bad. It knows they are common. Frequency in training data drives generation probability, not security quality.
The vulnerability categories and OWASP mappings above are sourced from the OWASP Top 10 Web Application Security Risks (2025 edition), Veracode's State of Software Security report (2026), and Cloud Security Alliance research on AI-generated code security (2026). The 2.74x vulnerability density figure is from Veracode.
Tool Walkthrough: The Security Scanner Ecosystem
| Tool | Category | Best For | License | Key Strength |
|---|---|---|---|---|
| Semgrep | SAST | PR-level speed, custom rules | LGPL 2.1 (OSS) | Sub-second scans, policy-as-code |
| CodeQL | SAST | Deep semantic analysis | Free for OSS | Data-flow tracking, reachability analysis |
| Snyk Code | SAST + SCA | Unified platform | Commercial (free tier) | DeepCode AI trained on AI-generated patterns |
| gitleaks | Secret Scanner | Pre-commit speed | MIT | Millisecond regex matching, pre-commit hooks |
| trufflehog | Secret Scanner | Deep scanning + verification | AGPL 3.0 | Live secret verification via safe API calls |
| npm audit | SCA | Node.js baseline | Built-in | Zero-config, runs with any npm project |
| Dependabot | SCA | GitHub-native workflows | Free (GitHub) | 3-day cooldown on new versions (2026) |
Semgrep: Quick Start
Semgrep is a SAST tool that uses pattern-based rules to find vulnerabilities. It scans in sub-second time on typical PRs, supports 30+ languages, and lets you write custom rules to enforce organization-specific security policies (Source: semgrep.dev). Its "Semgrep Assistant" uses AI to help iterate on rule authorship.
# Install and run Semgrep with security-focused rules pip install semgrep semgrep --config=p/security-audit ./src # Run the OWASP Top 10 ruleset semgrep --config=p/owasp-top-ten ./src # Scan only the files changed in a PR semgrep --config=p/security-audit --diff-aware
gitleaks: Secret Detection
gitleaks detects hardcoded secrets using regex-based pattern matching. It runs in milliseconds and is designed to be a pre-commit hook, catching credentials before they enter the repository (Source: github.com/gitleaks/gitleaks).
# Install gitleaks
brew install gitleaks # macOS
# or download from GitHub releases
# Scan the current repository
gitleaks detect --source=. --verbose
# Install as a pre-commit hook
# In .pre-commit-config.yaml:
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.21.0
hooks:
- id: gitleaks
trufflehog: Deep Scanning with Verification
trufflehog scans Git history, S3 buckets, Docker images, and more. Its key advantage is verifier modules that make safe, read-only API calls to confirm whether a detected secret is actually live, reducing alert fatigue (Source: github.com/trufflesecurity/trufflehog).
# Scan entire Git history with live verification trufflehog git file://. --only-verified # Scan a GitHub repository trufflehog github --repo=https://github.com/your-org/your-repo --only-verified
All tool descriptions above are verified against primary documentation (semgrep.dev, github.com/gitleaks, github.com/trufflesecurity, snyk.io, docs.github.com/codeql) as of July 2026. Feature sets, pricing, and licensing can change. Always verify against the tool's official docs before adopting.
Hands-On: The Hardening Build
Step 1: SAST Scan with Semgrep
Run Semgrep against your project. Focus on high and critical severity findings. A typical AI-generated Node.js project will surface injection flaws, missing input validation, and insecure crypto usage.
$ semgrep --config=p/security-audit ./src --json | jq '.results | length' 12 $ semgrep --config=p/security-audit ./src src/api/users.js severity: ERROR rule: javascript.express.security.audit.xss.mustache-escape 12: res.send(`${req.query.name}
`) fix: Sanitize user input before rendering in HTML responses. src/db/queries.js severity: ERROR rule: javascript.lang.security.audit.sqli.node-postgres 8: const result = await pool.query(`SELECT * FROM users WHERE id = '${userId}'`) fix: Use parameterized queries: pool.query('SELECT * FROM users WHERE id = $1', [userId])
Step 2: Fix the Injection
The SQL injection finding above is a textbook AI-generated vulnerability. The model built a working query using string interpolation. The fix is a parameterized query.
// BEFORE (AI-generated — vulnerable to SQL injection)
const result = await pool.query(
`SELECT * FROM users WHERE id = '${userId}'`
);
// AFTER (hardened — parameterized query)
const result = await pool.query(
'SELECT * FROM users WHERE id = $1',
[userId]
);
Step 3: Secret Scan with gitleaks
$ gitleaks detect --source=. --verbose Finding: AKIAIOSFODNN7EXAMPLE Secret: AKIAIOSFODNN7EXAMPLE RuleID: aws-access-key-id Entropy: 3.52 File: src/config/aws.js Line: 4 Commit: a1b2c3d # Fix: move the key to an environment variable # Delete the line from source, rotate the AWS key immediately # Add src/config/aws.js patterns to .gitignore if needed
Step 4: Dependency Audit
$ npm audit # high Prototype Pollution in lodash < 4.17.21 # fix: npm audit fix # or: npm install lodash@4.17.21 # Always use npm ci in CI/CD (respects lockfile exactly) $ npm ci
Run these three commands on your current project right now: semgrep --config=p/security-audit ./src, gitleaks detect --source=., npm audit. The three outputs give you an immediate picture of your AI-generated code's security posture. Fix the critical findings first. Then read Module 07 to make these checks permanent in your CI/CD pipeline.
Slopsquatting Defense: Catching Hallucinated Dependencies
How the Attack Works
- AI hallucinates a package name: your AI assistant suggests
pip install fastapi-middlewareornpm install react-auth-helper. The package does not exist. - Attacker registers the name: attackers monitor AI models for frequently hallucinated names and pre-register them on npm or PyPI (Source: Seth Larson, Snyk, Palo Alto Networks 2025-2026).
- Developer runs the install: the malicious package enters the project, potentially stealing credentials, installing backdoors, or executing arbitrary code.
With autonomous coding agents, the install can happen without human review. The AI both generates the hallucinated dependency name and executes the installation command. This creates an infection path with zero human oversight. Never allow AI agents to run package installation commands without an explicit human approval step or a pre-approved dependency allowlist (Source: Cloud Security Alliance 2026, Mallory.ai).
Defense Checklist
- Verify before installing: check that every AI-suggested package exists on the official registry (npmjs.com, pypi.org). Check the publisher identity, download count, and registration date. A package registered last week with 12 downloads is suspicious.
- Pin dependencies: lock every dependency to an exact version in your lockfile. Avoid semver ranges (
^or~) that auto-update to potentially compromised patches. - Use
npm ciin CI/CD: unlikenpm install,npm cirespects the lockfile exactly and fails if the lockfile does not matchpackage.json. - Verify provenance: where available, verify package provenance attestations that confirm build integrity (Source: GitHub Blog, npm documentation).
- Generate an SBOM: use CycloneDX or SPDX to generate a Software Bill of Materials on every build. This creates an auditable inventory of every dependency, making it possible to trace hallucinated packages after the fact (Source: CISA AI-BOM guidance, May 2026).
Catching a Hallucinated Package
# AI suggested: npm install express-secure-session # Step 1: Check if it exists npm view express-secure-session # If the response is "npm ERR! 404 Not Found" — the package does not exist. # The AI hallucinated it. Do NOT install. # Step 2: If it exists, check metadata npm view express-secure-session time created npm view express-secure-session maintainers # Red flags: created recently, single anonymous maintainer, very low downloads # Step 3: Check for known alternatives npm search secure session # Use the established, well-maintained package instead
By 2026, slopsquatting has evolved into more advanced variants. HalluSquatting combines hallucinated resources with prompt injection to force agents to execute unauthorized code. Phantom Squatting extends the concept from packages to hallucinated web domains and API endpoints (Source: Palo Alto Networks 2026). The defense remains the same: verify before you trust.
CI/CD Security Gates: Automated Protection
GitHub Actions: Three-Gate Security Pipeline
# .github/workflows/security-gates.yml
name: AI Code Security Gates
on: [pull_request]
jobs:
sast-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Semgrep SAST
uses: returntocorp/semgrep-action@v1
with:
config: p/security-audit p/owasp-top-ten
# Semgrep action exits non-zero on findings by default
secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history for git scanning
- name: Run gitleaks
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
dependency-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '22'
- run: npm ci
- name: Audit dependencies
run: npm audit --audit-level=high
# Exits non-zero if high/critical vulns found
Making Gates Required
After the workflow runs, configure the three jobs as required status checks in your repository settings. Navigate to Settings, then Branches, then Branch protection rules. Add sast-scan, secret-scan, and dependency-audit as required checks. With this configuration, no pull request can merge until all three gates pass.
All three gates use open-source tools. Semgrep OSS, gitleaks, and npm audit are free. GitHub Actions provides 2,000 free minutes per month for public repositories and a generous free tier for private repositories. The entire security pipeline costs nothing to run.
Prompt Injection Defense for AI-Built Applications
The OWASP Top 10 for LLM Applications (2025)
| Rank | Risk | Relevance to Vibe Coders |
|---|---|---|
| LLM01 | Prompt Injection | Any app that passes user text to a model |
| LLM05 | Improper Output Handling | Rendering AI output without sanitization |
| LLM03 | Supply Chain Vulnerabilities | Third-party models, datasets, plugins |
| LLM06 | Excessive Agency | AI agents with too many permissions |
| LLM02 | Sensitive Information Disclosure | PII leakage through model outputs |
| LLM07 | System Prompt Leakage | Users extracting your system instructions |
Five-Layer Defense
- Input separation: use distinct API message roles (
systemvsuser) to keep developer instructions separate from user input. Never concatenate them into a single string. - Strict input validation: validate all user input against allowlists and schema constraints before it reaches the model. Reject inputs that contain instruction-like patterns.
- Output monitoring: scan model outputs for forbidden patterns, system prompt fragments, or sensitive data before relaying them to the user.
- Human-in-the-loop: for high-stakes actions (deleting data, sending emails, executing code), require explicit human authorization before the AI's suggested action is executed (Source: OWASP GenAI Security Project).
- Least privilege: design systems under the assumption that injection will succeed. Give the LLM only the minimum permissions needed. An injected model with read-only database access causes less damage than one with admin privileges.
No input filter is 100% effective against prompt injection. Researchers continue to find novel bypass techniques. The correct architecture assumes that injection will eventually succeed and limits the blast radius through least-privilege permissions, action logging, and human approval gates for irreversible operations (Source: OWASP Top 10 for LLM Applications 2025).
Threat Modeling AI-Built Features
AI-Specific Threat Model Questions
Hallucinated Dependencies
Did the AI suggest any packages that do not exist in the public registry? Verify every import and install command against npmjs.com or pypi.org before accepting the code.
Exposed Secrets
Did the AI store API keys, database passwords, or tokens in source code instead of environment variables? Run gitleaks on every commit to catch this automatically.
Input Validation
Does every endpoint, form handler, and database query validate its input? AI-generated code routinely skips validation because it is not needed for the "happy path" the model was trained on.
Access Control
Does the feature enforce authentication and authorization on every route? AI often generates routes without middleware. Check that no endpoint is accessible without proper credentials.
The Review-Before-Merge Protocol
The most effective security practice for AI-generated code is the simplest: review before you merge. Not every line. Focus your human review on four areas:
- Authentication logic: login flows, session handling, token validation.
- Database queries: any code that reads from or writes to a database.
- API endpoints: routes that accept user input or return sensitive data.
- Dependency additions: any new package added to package.json or requirements.txt.
Automated tools catch the patterns. Human review catches the logic flaws that require business context to identify. The combination is what makes the system effective.
This security masterclass pairs with the Evals and Testing AI Output masterclass. Together they form the quality gate for AI-built software. Evals catch correctness failures (the AI output is wrong). Security scanning catches safety failures (the AI output is exploitable). Ship neither without both gates passing.
Frequently Asked Questions
AI models reproduce insecure patterns from their training data. Research from Veracode and the Cloud Security Alliance shows that approximately 45% of AI-generated code samples contain vulnerabilities mapped to the OWASP Top 10. AI-generated code carries a 2.74x higher vulnerability density than human-written code because models prioritize functional correctness over security, producing code with missing input validation, hardcoded secrets, and insecure default configurations.
Slopsquatting is a supply-chain attack where attackers register malicious packages using names that AI models hallucinate. The term was coined by developer-in-residence Seth Larson. When an AI coding assistant suggests a non-existent package, attackers pre-register that name on npm or PyPI. If a developer runs the install command, the malicious package enters their project. Hallucinations are repeatable across sessions, making them predictable targets for attackers. Defense requires verifying every AI-suggested package against the registry before installing.
Three tools cover the primary SAST needs for AI-generated code. Semgrep provides sub-second PR-level scanning with custom rules and is widely used for enforcing organization security policies. CodeQL offers deep semantic analysis with data-flow tracking for complex logic flaws. Snyk Code uses DeepCode AI trained on vulnerability patterns in AI-generated code and provides a unified platform combining SAST, SCA, and container security. Most teams use a layered approach: a fast scanner like Semgrep on every PR plus a deeper engine for governance.
Use gitleaks as a pre-commit hook to catch secrets before they enter the repository. It uses regex-based pattern matching and runs in milliseconds. For deeper scanning across Git history, S3 buckets, and Docker images, use trufflehog, which includes verifier modules that make safe read-only API calls to confirm whether a detected secret is actually live. The 2026 best practice is to combine both: gitleaks at the pre-commit stage and trufflehog as a CI/CD pipeline gate.
The most common vulnerabilities mapped to OWASP categories are: Broken Access Control (missing authentication middleware, absent row-level security), Injection Flaws (SQL injection, XSS, command injection from missing input validation), Security Misconfiguration (insecure default settings, debug mode enabled), Cryptographic Failures (hardcoded API keys, weak hashing algorithms), and Server-Side Request Forgery through unvalidated URL inputs. AI models reproduce these patterns because they appear frequently in training data without the security context that tells a human developer they are dangerous.
Add three gates to your CI/CD pipeline: a SAST scan (Semgrep or CodeQL) that fails the build on high-severity findings, a dependency scan (npm audit, Snyk, or Dependabot) that blocks merges with known vulnerable packages, and a secret scan (gitleaks) that rejects any commit containing detected credentials. Configure each gate as a required check in your GitHub Actions workflow so pull requests cannot merge until all three pass. This catches the three highest-risk categories in AI-generated code: code vulnerabilities, supply chain risks, and secrets exposure.
Dependency pinning means locking every dependency to an exact version in your lockfile rather than using semver ranges. It matters for AI-generated code because AI models frequently suggest packages without specifying versions, defaulting to the latest available. If a package is later compromised, unpinned dependencies automatically pull the malicious version. Always use lockfiles, run npm ci instead of npm install in CI/CD, and verify package provenance attestations where available.
A Software Bill of Materials is a complete inventory of every component, library, and dependency in your project. For AI-generated code, SBOMs are critical because the developer often does not know what dependencies the AI introduced. CISA and G7 partners released joint AI-BOM guidance in May 2026 recommending documentation of models, datasets, and dependencies. CycloneDX and SPDX are the two primary standards. Generate your SBOM automatically in CI/CD so it stays current with every build.
Prompt injection is ranked the number-one risk in the OWASP Top 10 for LLM Applications 2025. Defend with five layers: separate system instructions from user input using distinct API message roles, validate all user input against allowlists before it reaches the model, scan model outputs for forbidden patterns before relaying them to users, require human authorization for high-stakes actions like deleting data or sending emails, and design systems under the assumption that injection will succeed by applying least-privilege permissions to all LLM tool access.
The OWASP Top 10 for LLM Applications (2025 edition) is the industry-standard framework for AI security risks. The ten risks are: Prompt Injection, Sensitive Information Disclosure, Supply Chain Vulnerabilities, Data and Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector and Embedding Weaknesses, Misinformation, and Unbounded Consumption. For vibe coders building with AI, the three most relevant are Prompt Injection, Improper Output Handling, and Supply Chain Vulnerabilities.
The two classes form a quality gate pair. The Evals and Testing masterclass covers output correctness: measuring whether AI-generated content is accurate, faithful, and relevant. This Security masterclass covers output safety: ensuring AI-generated code does not introduce exploitable vulnerabilities. Together they address the two failure modes of AI-built software: it can be wrong (evals) and it can be dangerous (security). Complete both for full coverage.
Yes for security-critical paths. No for every line in every file. The practical approach is to treat AI-generated code as untrusted input: run automated SAST, SCA, and secret scanning on everything, then focus manual review on authentication logic, database queries, API endpoints, and any code that handles user input or sensitive data. Automated tools catch the systematic patterns. Human review catches the logic flaws that require business context to identify.
Threat modeling is the practice of systematically identifying what can go wrong with a feature before you build it. For AI-built features, add three AI-specific questions to your threat model: what happens if the AI hallucinated a dependency that does not exist, what happens if a user injects malicious instructions through an input field the AI built, and what happens if the AI stored a secret in the source code instead of an environment variable. Run this analysis on every feature that touches authentication, data storage, or external APIs.
Nothing. This masterclass is 100% free. No signup, no email, no paywall, no certificate requirement. It is part of the DDS Vibe Academy, a free AI coding curriculum built by Robert McCullock at Design Delight Studio.
Start with Module 03 of this masterclass: The Vulnerability Taxonomy. Read through the six categories to understand what to look for. Then jump to Module 05: the hands-on build where you install Semgrep and gitleaks, scan a project, and set up your first CI/CD security gate. The setup takes under 30 minutes. After that, read Module 06 on slopsquatting defense to protect your dependency tree. The entire hardening workflow can be operational in a single afternoon.