AI coding agents can now do much more than suggest code. They can read project files, create new modules, install packages, execute commands, modify configurations, and submit pull requests.
This makes development faster, but it also creates security risks.
An AI agent might generate an API endpoint without proper authorization checks, introduce an outdated dependency, expose a secret in a configuration file, or modify a deployment script in an unsafe way.
The problem is not limited to incorrect code. An agent can also read malicious instructions from a README file, issue description, website, or other external content and use its available tools in unintended ways.
Developers should not assume that AI-generated code is secure simply because it passes the build or test suite.
In this article, we will build a security-checking process for AI agent changes. We will look at code review, dependency checks, secret detection, automated testing, and approval controls before merging code into the production branch.
Why AI Agent Code Needs Security Checks
Consider a developer who asks an AI agent to create a login API.
The agent creates the controller, database query, password validation, and authentication response. The application compiles, and the generated tests pass.
However, the implementation might contain problems such as:
- SQL queries created using string concatenation.
- Missing authorization checks.
- Weak password-handling logic.
- Hardcoded API keys.
- Unnecessary third-party packages.
- Sensitive information written to application logs.
- Unsafe file or shell operations.
These problems can exist even when the generated code looks correct.
An AI agent can also modify files outside the requested task. For example, while implementing an API feature, it might change a GitHub Actions workflow or a Dockerfile.
This is why security checks should apply to every change, regardless of whether it was written by a developer or generated by an AI agent.
Design a Security Check Before Production
A practical security process should run before code is merged into the main branch.
The following workflow provides a useful starting point:
Developer Request
|
v
AI Coding Agent
|
v
Generate Code Changes
|
v
Create Pull Request
|
v
Security Checks
|
+----------------------+
| |
v v
Static Code Analysis Dependency Scan
| |
v v
Secret Detection Security Tests
| |
+----------+-----------+
|
v
Review Results
|
v
Human Approval
|
v
Merge Code
|
v
Deployment
The important point is that the security checks happen before merging.
A successful build alone should not be enough to approve an AI-generated change.
Check the Code for Common Security Problems
Static Application Security Testing (SAST) examines source code without running the application.
It can identify patterns that may indicate security problems.
For example, consider the following Python code:
def get_user(cursor, user_id):
query = (
"SELECT * FROM users WHERE id = "
+ str(user_id)
)
cursor.execute(query)
return cursor.fetchone()
This code builds a SQL statement by concatenating user input. It can introduce SQL injection vulnerabilities.
A safer implementation uses parameterized queries:
def get_user(cursor, user_id):
query = """
SELECT *
FROM users
WHERE id = %s
"""
cursor.execute(query, (user_id,))
return cursor.fetchone()
The database driver handles the parameter separately from the SQL statement.
For Python projects, Bandit is one option for identifying common security issues in source code.
Install it:
pip install bandit
Run the scan:
bandit -r src/
Bandit examines Python source code for known risky patterns and reports findings with severity and confidence information.
It does not detect every possible vulnerability. Use it alongside code review, dependency analysis, and application testing.
Check Third-Party Dependencies
AI agents sometimes introduce new packages while implementing a feature.
For example, an agent might add a package to handle JWT authentication, process files, or communicate with an external API.
Before accepting the change, review the dependency.
Check:
- Whether the package actually exists.
- Whether it comes from the expected package registry.
- Whether the package is maintained.
- Whether it contains known vulnerabilities.
- Whether the selected version is appropriate.
- Whether the application really needs the package.
For Python applications, pip-audit can identify known vulnerabilities in installed packages or dependency requirements.
Install it:
pip install pip-audit
Scan the project dependencies:
pip-audit -r requirements.txt
The tool compares package versions against known vulnerability information.
For example, if an AI agent introduces an outdated version of a library with a published security advisory, the scan can identify it.
A clean result does not guarantee that a dependency is safe. Newly discovered vulnerabilities, malicious packages, and compromised package maintainers might not appear in vulnerability databases immediately.
Also review unexpected changes to requirements.txt, lockfiles, and package installation scripts.
Detect Secrets Before Code Is Merged
One of the most serious mistakes an AI agent can make is placing credentials directly into source code.
For example:
DATABASE_PASSWORD = "MyDatabasePassword123"
API_KEY = "example-secret-value"
Even if these values are only intended for development, committing them to a repository can expose them to other users or automated systems.
Use secret scanning to identify credentials in source files and commits.
GitHub Secret Scanning can detect supported secret formats in repositories and alert developers when potential secrets are found.
You can also use tools such as Gitleaks to scan repositories for exposed credentials.
For example:
gitleaks git .
The exact command and configuration should follow the installed Gitleaks version.
A secret scanner should be part of the pull request process, not something developers run only after a security incident.
If a real credential is exposed, removing it from the source file is not enough. Revoke or rotate the credential and investigate whether it was accessed.
Add Security Checks to GitHub Actions
Let's combine some of these checks into a GitHub Actions workflow.
Assume that the project has the following structure:
my-ai-project/
│
├── src/
├── tests/
├── requirements.txt
└── .github/
└── workflows/
└── security-check.yml
Create security-check.yml:
name: AI Code Security Check
on:
pull_request:
branches:
- main
permissions:
contents: read
jobs:
security:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.15"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install bandit pip-audit pytest
- name: Check dependencies
run: |
pip check
pip-audit -r requirements.txt
- name: Run security scan
run: |
bandit -r src/
- name: Run tests
run: |
pytest tests/
This workflow runs when a pull request targets the main branch.
It performs four checks:
- Installs the project dependencies.
- Checks dependency consistency and known vulnerabilities.
- Scans Python source code using Bandit.
- Runs the application's test suite.
For production repositories, pin GitHub Actions to reviewed commit SHAs instead of relying only on mutable version tags. Also configure the appropriate permissions and trusted execution environment for your organization.
This example is a starting point, not a complete security pipeline. Add secret scanning and any language-specific security tools required by your project.
Check AI Agent Permissions
Source code scanning is only one part of AI agent security.
An AI coding agent might have access to the local filesystem, terminal, network, package managers, cloud credentials, and repository settings.
If the agent receives malicious instructions through a document or external tool response, it might attempt actions beyond the developer's original request.
For example, an agent working on a database feature might read a malicious instruction in a repository file that tells it to upload environment variables to an external server.
The security pipeline cannot prevent every such action after the fact. You must also restrict what the agent can access and execute.
Use the following controls:
| Security control | Purpose |
|---|
| Least privilege | Give the agent only the permissions required for its task |
| Sandboxing | Restrict access to the developer's machine and sensitive files |
| Command allowlists | Limit which shell commands the agent can execute |
| Network restrictions | Prevent unnecessary outbound connections |
| Temporary credentials | Avoid exposing long-lived developer or production credentials |
| Human approval | Require approval for sensitive or irreversible actions |
| Audit logs | Record important tool calls and execution results |
For example, an agent that only needs to modify a Python service should not automatically receive access to production deployment credentials or cloud administration permissions.
Use short-lived, task-specific credentials where access is necessary.
Add Security Checks for AI Applications and Agents
There is another important difference between ordinary application security and AI application security.
An application that uses an AI agent can introduce risks that traditional source code scanners might not identify.
Consider an agent that reads external websites and uses their content to decide which tools to execute.
An attacker could place malicious instructions inside a webpage. If the agent treats that content as trusted instructions, it might reveal sensitive information or perform an unauthorized operation.
This is an example of indirect prompt injection.
Other risks include:
- Excessive agency, where an agent has more permissions than necessary.
- Sensitive information disclosure.
- Unsafe tool execution.
- Insecure handling of external tool responses.
- Unauthorized actions performed through connected services.
GitHub provides AI applications scanning to detect certain security risks in AI applications and agents, including indirect prompt injection, sensitive information disclosure, and excessive agency.
This capability is currently in public preview and has specific GitHub Advanced Security licensing requirements. Check its current availability before planning to use it.
For broader security guidance, OWASP also provides dedicated guidance for AI agents and AI-assisted development.
Require Human Review Before Merging
Automated checks cannot replace code review.
A security scanner might report that the code contains no known vulnerability, but it cannot guarantee that the implementation follows the application's business security requirements.
For example, an API might use correct authentication but still allow one customer to access another customer's records.
A developer must review the authorization logic and confirm that access is restricted correctly.
Pay particular attention to changes involving:
- Authentication and authorization.
- Payment processing.
- Database access.
- Encryption and cryptographic operations.
- API keys and credentials.
- Deployment workflows.
- Dockerfiles and infrastructure configuration.
- Security-related tests.
Also review changes to existing tests. An AI agent might remove a failing test or weaken an assertion to make the build pass.
A passing test suite is not useful if the tests no longer verify the expected behavior.
Configure required pull request reviews and status checks so that code cannot be merged simply because the AI agent reports that its task is complete.
Common Mistakes to Avoid
Trusting the AI agent's security explanation
An agent might explain why its code is safe, but that explanation is not evidence that the implementation is secure.
Verify the actual code and test results.
Running only unit tests
Unit tests can verify application behavior, but they do not replace dependency scanning, secret detection, and static security analysis.
Giving agents production credentials
Development agents should not receive unrestricted access to production systems.
Use isolated environments and scoped credentials.
Ignoring configuration changes
An AI agent might modify CI workflows, Dockerfiles, or deployment scripts. These changes can affect the entire application delivery process and should receive additional review.
Treating a clean scan as a security guarantee
Automated tools detect specific classes of problems. They cannot identify every vulnerability or business logic issue.
Summary
AI coding agents can generate code quickly, but their changes must pass the same security checks as code written by developers. Build a process that combines static code analysis, dependency scanning, secret detection, application tests, and restricted agent permissions. Run these checks on pull requests and require human approval before merging sensitive changes. For AI applications, also examine risks such as indirect prompt injection, excessive permissions, and sensitive information disclosure. The goal is to make security checks a normal part of the development process so that vulnerable AI-generated code does not reach production unnoticed.
Join the conversation! Your thoughts help the community grow.