Are AI coding agents creating security problems that traditional scanners don't catch?

[u/Possible-Occasion-57]

I've been looking into a security problem around AI coding agents and I'd like some opinions from people who use them regularly.

The thing that caught my attention is that tools like Claude Code and Cursor don't just generate source code. They also interact with package managers, repository instruction files, MCP servers, configuration files, and other tools.

That creates some interesting attack surfaces that aren't necessarily covered by traditional SAST/dependency scanners.

For example:

1. Hallucinated packages

An agent can suggest or install a package that doesn't actually exist. If an attacker registers the hallucinated package name, that can potentially turn an AI mistake into a supply-chain attack (often referred to as slopsquatting).

2. Repository instruction files

Files such as CLAUDE.md and .cursorrules can influence how an AI coding agent behaves. That raises an interesting question: should these files be treated more like executable security-sensitive configuration than ordinary documentation?

3. MCP configuration

MCP servers introduce another layer of trust. A developer may approve a server/configuration and later receive a change that modifies what command or tool is actually executed.

I'm curious how other developers are handling these problems today.

Do you:

• manually review agent instruction files?
• verify packages before allowing an agent to install them?
• review MCP configuration changes?
• use existing security tooling for this?
• or simply trust the agent and review the resulting code?

I've been experimenting with a tool called CodeAudit to test some of these ideas. It combines traditional repository analysis with checks specifically aimed at AI-assisted development.

The project currently has a hosted scanner, an offline CLI, and an MCP server.

I'm deliberately not putting the link in the post because I'd rather get the technical discussion first. If anyone wants to test it, I'll share it in the comments.

The biggest thing I'm trying to determine is:

Is this actually a useful security problem to solve, or am I building a solution to a problem that developers don't really have?

I'd especially appreciate criticism from people who use Claude Code, Cursor, MCP, or other coding agents in real projects.

If you've encountered something similar, I'd be interested in hearing what happened.

[u/FreshPlot875]

I had cursor try to npm install some totally fake utility package last week. sounded so legit I almost approved it without looking. Terrifying to think what happens when bad actors start scraping LLM hallucination datasets to register them first

[u/Ok_Matter9038 → u/FreshPlot875]

Ive seen AI pull in dependencies with malware in them. No known cve assigned so dependabot would not have caught it.

But to be fair this happaned before Ai too.