{
  "id": 171716,
  "title": "How to secure AI generated code from prompt to pentest",
  "url": "https://urgent.news/2026/08/05/how-to-secure-ai-generated-code-from-prompt-to-pentest",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-05T11:04:55.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/codacy/how-to-secure-ai-generated-code-from-prompt-to-pentest-30b2"
  },
  "original_language": "en",
  "account": "A recent session featured insights from Jordan Constantine, Head of Offensive Security at WorkNest Secure, and Kendrick Curtis, CTO of Codacy. They discussed vulnerabilities in AI-assisted development, focusing on four main classes. First, insecure dependencies and malware can arise from agents pulling outdated packages due to stale training data or an overrepresentation of older versions in the training corpus. Secondly, agents default to the latest versions, which can be risky. Thirdly, the use of slopsquatting, where the model makes typos that it then propagates at scale. Lastly, an added vulnerability is the model's tendency to use bleeding-edge packages instead of remediation suggestions.\n\nThe most effective fix, according to the session, is setting a minimum age in the .npmrc file. This insulates against the majority of bleeding-edge dependency risks. To combat older, known-vulnerable versions, a version database is essential. Verity handles this by running a CLI within the agent to correct versions before they are deployed.\n\nA different threat involves malicious MCP servers, which act as a wrapper around an API, creating a middleman in the code path on both developer machines and in production. Instead of banning these servers, a curated allowlist and scoped tokens per server can contain the potential harm.\n\nAnother risk is prompt injection, where an attacker can manipulate computers using English. On a developer's machine, a text file within a dependency instructing the agent to read environment variables and post them can be enough to compromise security. Containment is critical here by sandboxing the agent, controlling what crosses the boundary, and using short-lived keys in environment variables.\n\nAgents execute as the user, with the user's permissions, including dropping to a terminal. Any perceived AI failure, such as deleting a production database, is often a permissions failure. Agents should operate with read-only permissions or a clone if they must have production access, with the script they write reviewed thoroughly.\n\nFrom an attacking perspective, guardrails can be bypassed without exploiting zero-days. Role-play and pretexting, indirect injection hidden within documents, task decomposition into harmless steps, and spacing/encoding tricks can all contribute to bypassing guardrails. These tactics are structurally similar to XSS and SQLi filter evasion but occur at a different surface level. A walkthrough example showed how a chatbot could reveal password hashes by exploiting a well-configured web app and using user enumeration.\n\nMitigating these risks requires treating AI like infrastructure. AI should be granted the access level of a service but with the governance of a feature. Proper least privilege should be applied to the agent's token, with a human in the loop for defined actions. Incident response must work in hours, accepting false positives and making decisions on usability versus security. A notable takeaway from the Q&A highlighted missing authorization on API endpoints as the hardest AI-generated vulnerability to catch in review, as scanners excel at identifying present flaws, while humans and tools struggle with spotting the absence of expected elements.",
  "summary": "We ran a session with Jordan Constantine, Head of Offensive Security at WorkNest Secure. Codacy CTO Kendrick Curtis covered what goes wrong while the code is being written; Jordan covered what he finds when he's paid to attack it afterwards. 4 vulnerability classes in AI-assisted development: Insecure dependencies and malware. Agents are insecure by default on versions: stale training data means…",
  "key_points": [],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/171716.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}