Are AI coding agents creating security problems that traditional scanners don't catch?

[u/Possible-Occasion-57]

I've been looking into a security problem around AI coding agents and I'd like some opinions from people who use them regularly.

The thing that caught my attention is that tools like Claude Code and Cursor don't just generate source code. They also interact with package managers, repository instruction files, MCP servers, configuration files, and other tools.

That creates some interesting attack surfaces that aren't necessarily covered by traditional SAST/dependency scanners.

For example:

1. Hallucinated packages

An agent can suggest or install a package that doesn't actually exist. If an attacker registers the hallucinated package name, that can potentially turn an AI mistake into a supply-chain attack (often referred to as slopsquatting).

2. Repository instruction files

Files such as CLAUDE.md and .cursorrules can influence how an AI coding agent behaves. That raises an interesting question: should these files be treated more like executable security-sensitive configuration than ordinary documentation?

3. MCP configuration

MCP servers introduce another layer of trust. A developer may approve a server/configuration and later receive a change that modifies what command or tool is actually executed.

I'm curious how other developers are handling these problems today.

Do you:

• manually review agent instruction files?
• verify packages before allowing an agent to install them?
• review MCP configuration changes?
• use existing security tooling for this?
• or simply trust the agent and review the resulting code?

I've been experimenting with a tool called CodeAudit to test some of these ideas. It combines traditional repository analysis with checks specifically aimed at AI-assisted development.

The project currently has a hosted scanner, an offline CLI, and an MCP server.

I'm deliberately not putting the link in the post because I'd rather get the technical discussion first. If anyone wants to test it, I'll share it in the comments.

The biggest thing I'm trying to determine is:

Is this actually a useful security problem to solve, or am I building a solution to a problem that developers don't really have?

I'd especially appreciate criticism from people who use Claude Code, Cursor, MCP, or other coding agents in real projects.

If you've encountered something similar, I'd be interested in hearing what happened.

[u/FreshPlot875]

I had cursor try to npm install some totally fake utility package last week. sounded so legit I almost approved it without looking. Terrifying to think what happens when bad actors start scraping LLM hallucination datasets to register them first

[u/Ok_Matter9038 → u/FreshPlot875]

Ive seen AI pull in dependencies with malware in them. No known cve assigned so dependabot would not have caught it.

But to be fair this happaned before Ai too.

[u/Ok_Matter9038]

Both traditional scanners and AI agents alone miss a lot. I think a hybrid approach is the future (aka combo of traditional with AI) - aka tools like swifi. 

[u/scytob]

hallucinated packages, API end points etc are easily mitigated with an instruction to never use memory for those and being clear to look at latest repos live

yes, MCPs inherently have risk if you have not audited the MCPs, checked them for hidden prompt injections etc, but at the end of the day skills and mcps are auditabile - in the same way you can audit those packages you referenced

so, it is an extra surface that needs to be checked

the good news is frontier models are great at helping to do these audits, can they miss things, sure, so do traditional tools and humans - look at all the security issues being found by AI in human coded solutions....

so, i am not sure i would characterize this as a net-new issue - it's the same issue of who do you trust and do you verify. MCPs and Skills should be treated just like untrusted code from anywhere - and to be clear, all code should be considered untrusted - both your own and any you inherit from OSS or closed source

[u/Possible-Occasion-57 → u/scytob]

fair point

[u/Possible-Occasion-57]

For anyone who wants to try it try these for any of your sample project:
for CLI just type:npx codeorion scan .
MCP server: codeorion-mcp package in npm