AI Coding Agents and Security Risks: What You Need to Know

Apiiro tracked 7,000 developers across 62,000 repositories in 2025 and found that AI coding assistants introduced over 10,000 new security findings per month -- a 10x spike in just six months. Developers shipped code 4x faster. They also shipped privilege escalation paths 322% more often and leaked cloud credentials nearly twice as frequently as developers who wrote code manually.

That's the deal you're making every time you hit "Accept All" on an AI-generated diff. You get speed. You also get a new category of security risks that didn't exist two years ago -- from hallucinated packages that attackers squat on, to MCP configurations that silently swap in malicious payloads, to AI agents that accumulate permissions like a developer who never logs out.

This guide covers the specific security risks AI coding agents introduce in 2026, the data behind them, and what you can actually do about it without giving up the productivity gains.

📋 What You'll Need

• Familiarity with at least one AI coding tool -- Cursor, Copilot, Claude Code, Windsurf, or similar
• A working codebase -- the risks in this article are concrete, not theoretical
• Access to a SAST/DAST tool -- Snyk, SonarQube, Semgrep, or similar static analysis
• A package manager -- npm, pip, cargo, etc. (you'll want to audit your dependencies)
• 30 minutes -- to audit your current AI coding workflow against the checklist at the end

🔬 The Vulnerability Data: What the Studies Actually Say

Let's start with the numbers, because the discourse around AI-generated code security ranges from "it's fine" to "we're all going to die." The truth is in the data.

Veracode: 45% Security Failure Rate

Veracode tested code generated by over 100 LLMs across Java, JavaScript, Python, and C# in 2025. The result: AI-generated code introduced risky security flaws in 45% of tests. Java was the worst offender, with a 72% security failure rate across tasks. That's not a rounding error -- nearly three out of four Java snippets from an LLM had a security flaw.

Apiiro: 10x Vulnerability Spike at Scale

The Apiiro study is the most comprehensive look at AI-generated code in production. Across 62,000 repositories with significant GitHub Copilot adoption:

Notice the pattern. AI tools are great at surface-level code quality -- fewer typos, fewer obvious bugs. But they're worse at the things that actually get you breached: authorization logic, secret management, and architectural decisions.

CodeRabbit: Specific Vulnerability Multipliers

CodeRabbit's December 2025 analysis quantified exactly how much more likely AI-generated code is to introduce specific vulnerability types compared to human-written code:

These aren't obscure edge cases. XSS and insecure direct object references are OWASP Top 10 staples. Your AI coding agent is almost three times more likely to write code vulnerable to cross-site scripting than you are.

🧬 Supply Chain Attacks: Slopsquatting and Hallucinated Packages

Traditional supply chain attacks rely on typosquatting -- registering reqeusts and hoping someone misspells requests. AI coding agents introduced an entirely new variant: slopsquatting.

How Slopsquatting Works

LLMs hallucinate. When they hallucinate package names, they don't generate random strings -- they generate plausible-sounding packages that don't exist. A 2025 study across 756,000 code samples found that nearly 20% recommended non-existent packages. Attackers register these hallucinated names on PyPI, npm, or crates.io and load them with malware.

Here's the attack flow:

┌──────────────┐     ┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  Developer   │────►│  AI Agent    │────►│  Hallucinated│────►│  Malicious   │
│  asks for    │     │  recommends  │     │  package     │     │  code runs   │
│  a package   │     │  fake name   │     │  installed   │     │  on machine  │
└──────────────┘     └──────────────┘     └──────────────┘     └──────────────┘

The Numbers Are Alarming

That 58% repetition rate is the real danger. If an LLM consistently hallucinates the same package name, attackers can predict which fake packages to register. It's deterministic, exploitable, and scalable.

Real-World Example

In 2024, a researcher noticed AI models repeatedly hallucinating a Python package called huggingface-cli. They registered it on PyPI as an empty package. It got 30,000+ downloads in three months -- all from developers (or their AI tools) blindly installing what the model suggested.

Now imagine that package wasn't empty.

How to Defend Against Slopsquatting

1. Lock your dependencies. Use package-lock.json, Pipfile.lock, or Cargo.lock. Review every new dependency before it enters the lockfile.
2. Use dependency scanning tools. Socket, Snyk, and npm audit can flag suspicious packages based on behavior analysis, not just known CVEs.
3. Verify before you install. Check the package registry page. Look at download counts, maintainer history, and when the package was first published.
4. Pin exact versions. Don't use ^ or ~ version ranges for packages you haven't thoroughly vetted.

🎭 MCP and Tool Poisoning: The New Attack Surface

If you're using Cursor, Claude Code, or any agent that supports the Model Context Protocol (MCP), you've got a new attack surface that didn't exist before 2025.

MCPoison: Silent Code Execution via Cursor

In August 2025, Check Point Research disclosed MCPoison (CVE-2025-54136), a vulnerability affecting over 100,000 Cursor users. Here's how the attack worked:

1. Attacker adds a benign-looking MCP configuration (.cursor/rules/mcp.json) to a shared repository
2. Developer pulls the code and approves the MCP config in Cursor (a one-time prompt)
3. Attacker replaces the MCP configuration with a malicious payload
4. Cursor executes the malicious code -- every time the developer opens the project -- without re-prompting for approval

The vulnerability broke Cursor's trust model. Once you approved an MCP config, Cursor assumed it would stay trustworthy forever. But the underlying file could be silently swapped at any time.

The Broader MCP Risk

MCP is how AI coding agents connect to external tools -- databases, APIs, file systems, cloud services. Every MCP connection is an identity with credentials and permissions. The OWASP Top 10 for Agentic Applications (released December 2025) ranks these risks specifically:

Defending Against MCP Attacks

# Check for MCP configurations in any repo you clone
find . -name "mcp.json" -o -name ".mcp" -o -name "mcp.yaml" | head -20

# Review what MCP servers your IDE connects to
# In Cursor: Settings → MCP → Review active servers
# In Claude Code: Check ~/.claude/mcp_servers.json

Practical steps:

• Audit MCP configs after every git pull. Don't assume approved configs stay safe.
• Use allowlists for MCP servers. Only connect to servers you've explicitly vetted.
• Update your IDE. Cursor patched MCPoison in version 1.3 (July 2025). If you're on an older version, you're exposed.
• Treat MCP configs like .env files. Review them with the same scrutiny you'd give credentials.

🕵️ Data Leakage: What Your AI Agent Knows (and Shares)

Every AI coding agent needs context to work. That context includes your source code, your environment variables, your database schemas, and sometimes your customer data. The question is: where does that context go?

The Shadow AI Problem

A 2025 survey found that 48% of employees admitted uploading company data into public AI tools that security teams never approved. For developers specifically, this means:

• Pasting proprietary code into ChatGPT or Claude.ai to debug it
• Using free-tier AI coding tools that send code to third-party servers
• Installing unvetted IDE extensions that proxy code through unknown APIs

What Gets Leaked

How to Minimize Data Exposure

1. Use .aiignore or .cursorignore files. Most AI coding tools support ignore files that prevent sensitive directories from being indexed.

# .aiignore (Claude Code) or .cursorignore (Cursor)
.env
.env.*
secrets/
*.pem
*.key
config/credentials/
test/fixtures/customer_data/

2. Prefer tools with local processing. Claude Code processes context locally before sending to the API. Cursor offers a Privacy Mode. Know what your tool does with your code.

3. Separate test data from production data. Don't use real customer data in your test fixtures. Use synthetic data generators like Faker.

4. Audit your agent's context window. Most tools let you see what files are included in the current context. Review this before asking the agent to help with sensitive code.

🛡️ The AI Security Mitigation Checklist

Here's the practical checklist. Print it, pin it, make it part of your code review process. Each item maps to a specific risk category covered above.

Code Quality

• [ ] Run SAST on every AI-generated PR. Tools: Semgrep, SonarQube, Snyk Code
• [ ] Never merge AI-generated code without human review. Especially for auth, crypto, and data handling
• [ ] Add security-focused unit tests. Test for SQL injection, XSS, path traversal, and IDOR in AI-generated code
• [ ] Check for hardcoded credentials. AI models love to include example API keys that look suspiciously real
• [ ] Validate authorization logic manually. AI-generated code is 10x more likely to skip input validation

Supply Chain

• [ ] Verify every new dependency before adding it. Check registry pages for download count, creation date, and maintainer
• [ ] Use lockfiles religiously. package-lock.json, Pipfile.lock, Cargo.lock
• [ ] Enable dependency scanning in CI. Socket, Snyk, or npm audit on every build
• [ ] Be skeptical of AI-suggested packages you've never heard of. If it sounds plausible but you can't find docs, it might be hallucinated
• [ ] Pin exact versions for any dependency the AI suggested

Agent & Tool Security

• [ ] Audit MCP configurations after every git pull. Diffs should include MCP file changes
• [ ] Apply least-privilege to agent permissions. Don't give your AI agent write access to production databases
• [ ] Keep your IDE and AI extensions updated. Security patches ship regularly
• [ ] Review agent tool connections. Know every external service your agent can access
• [ ] Use allowlists for MCP servers. Block unknown servers by default

Data Protection

• [ ] Configure ignore files (.aiignore, .cursorignore, .claudeignore) before starting any session
• [ ] Never paste secrets into AI chat interfaces. Use environment variables, not inline credentials
• [ ] Use synthetic test data. Never let real customer PII enter your AI agent's context
• [ ] Audit what your agent sends to the API. Enable logging if your tool supports it
• [ ] Prefer tools with SOC 2 compliance and clear data retention policies

🔮 OWASP's Agentic AI Top 10: The Framework for 2026

In December 2025, OWASP released the Top 10 for Agentic Applications -- the first security framework specifically designed for AI agents. This matters because the existing OWASP Top 10 for LLMs focuses on the model itself, while the Agentic Top 10 focuses on what happens when that model has tools, permissions, and autonomy.

Here's the full list with practical relevance for developers using AI coding tools:

The theme across all 10 risks is the same: autonomy without oversight. The more you let your AI coding agent do without checking its work, the more surface area you expose.

The Practical Takeaway

You don't need to implement mitigations for all 10 risks today. Start with three:

1. Least privilege (#2). Don't give your agent credentials it doesn't need. If it's writing frontend code, it doesn't need database admin access.
2. Human review (#5). Every AI-generated change should be reviewed by a human before it reaches production. No exceptions for "small" changes.
3. Supply chain hygiene (#7). Vet your MCP servers, IDE extensions, and AI-suggested dependencies with the same rigor you'd apply to any third-party code.

🚀 What's Next

AI coding agents aren't going away -- they're getting more autonomous, more integrated, and more powerful. The security landscape will keep evolving. Here's where to focus next:

• Build security scanning into your CI/CD pipeline so AI-generated code gets the same scrutiny as human-written code -- automatically
• Adopt the OWASP Agentic AI Top 10 as a framework for evaluating your AI coding tool setup, starting with least privilege and human review checkpoints
• Explore AI-assisted code review tools that use AI to catch the security issues that other AI tools introduce -- fighting fire with fire, but deliberately. See our guide on AI Code Review Tools
• Stay current on MCP security as the protocol matures and more tools adopt it. The attack surface is expanding, and so are the defenses
• Re-evaluate your tool choices periodically -- security posture varies significantly between AI coding tools and updates ship frequently. Check our AI Coding Agents Compared guide for the latest

Want to understand how these AI coding tools work before worrying about their security risks? Start with our AI Coding Agents Compared guide for a practical breakdown of Cursor, Copilot, Claude Code, and Windsurf -- then come back here to lock them down. For the bigger picture on how AI is changing software engineering roles, read The Rise of the AI Engineer.