AI Security

On June 25, 2026, the Mozilla 0DIN team demonstrated an attack that should change how every team deploys AI coding agents. They published a normal-looking Python repository on GitHub. A developer cloned it and pointed Claude Code at it. The agent read the README, installed the requirements, hit a routine initialization error, and — trying to be helpful — ran the suggested fix. That fix queried a DNS TXT record, decoded the value, and executed it as a shell command, opening a reverse shell on the developer’s machine. ...

If your team is running AI coding agents in production — Claude Code, Cursor, Windsurf, GitHub Copilot — you’ve probably already felt the gap between traditional AppSec and what these agents actually do. Traditional security tools scan committed code. Agents don’t just write code; they install MCP servers, download skills, run shell commands, and make API calls. By the time a traditional SAST scan runs, the damage is already done. ...

Here’s a scenario I keep coming back to: you’re running PraisonAI locally to test a multi-agent workflow, you open a browser tab to check something on a forum, and within two seconds, a website you’ve never heard of has read your SSH private key, dumped your AWS credentials, and exfiltrated both to a server in another country. No pop-up, no redirect, no visible sign anything happened. That’s CVE-2026-56076 in practice. It’s a cross-origin agent execution vulnerability in PraisonAI versions before 1.5.128, rated CVSS 8.6 (v4) / 8.1 (v3.1). The POST /agui endpoint combines three failures — no authentication, hardcoded Access-Control-Allow-Origin: *, and Starlette’s Content-Type-agnostic JSON parsing — that lets any website a victim visits silently execute arbitrary agent commands and exfiltrate the results. I’ve been tracking the PraisonAI vulnerability landscape since the CVE-2026-44338 authentication bypass hit (exploited within 3 hours 44 minutes of disclosure), and this one scares me more because it bypasses every traditional network boundary. Your VPN, your firewall, your network ACLs — none of them matter when the attack comes from inside the browser. ...

Secure AI agents with least privilege by giving each agent a scoped identity, limiting tools and data, enforcing policy outside the prompt, using short-lived credentials, requiring approvals for high-impact actions, sandboxing execution, and logging every tool call for continuous permission review. Why does least privilege matter more for AI agents in 2026? Least privilege for AI agents is the practice of giving an autonomous workflow only the identity, data, tools, network access, memory, and approval rights it needs for a specific task. Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, so the blast radius of one over-permissioned agent is becoming a mainstream production risk. Traditional apps usually execute known code paths. Agents choose tools, summarize context, recover from failed calls, and may act on untrusted instructions hidden in emails, tickets, pages, or documents. That flexibility is useful, but it turns every tool call into an authorization decision. The goal is not to make prompts perfect. The goal is to make a malicious or mistaken prompt unable to read secrets, mutate production data, approve payments, or exfiltrate broad datasets. The takeaway: secure AI agents least privilege starts with limiting what the agent can actually do. ...

Agent goal hijacking is the OWASP ASI01 risk where an attacker redirects an AI agent from its intended objective toward a malicious or unauthorized outcome. The practical danger is not a weird answer; it is an autonomous workflow using tools, identity, memory, or production APIs to do the wrong thing. What Is Agent Goal Hijacking? Agent goal hijacking is an attack where malicious input changes an AI agent’s objective, plan, or decision path so the agent pursues the attacker’s goal instead of the user’s intended goal. OWASP ranks this as ASI01 in the OWASP Top 10 for Agentic Applications 2026, a peer-reviewed framework built with input from more than 100 experts. The risk matters because modern agents do more than generate text: they browse pages, read tickets, query RAG indexes, call APIs, update records, create pull requests, and send messages. A hijack can start with one hostile paragraph in a web page, PDF, email, or tool response, then unfold across several steps as the agent plans and acts. The core takeaway is simple: agent goal hijacking turns untrusted content into control-plane input for software that can take real actions. ...

AI-generated code contains 2.74x more security vulnerabilities than human-written code, yet 93% of organizations use it in production workflows while only 12% apply equivalent security standards. At 42% AI code adoption in 2026 — projected to hit 65% by 2027 — the security debt is compounding faster than engineering teams can address it. This guide explains the scale of the crisis and what to do about it. What Is AI Code Security Debt? AI code security debt refers to the accumulation of unaddressed vulnerabilities, quality defects, and governance gaps introduced by AI-generated code at a pace that exceeds a team’s capacity to review, fix, or audit it. The term adapts the traditional concept of technical debt — the cost of deferred code quality decisions — but adds a new dimension: AI tools generate code so fast that the debt accumulates not over months or years, but over hours. Veracode’s 2025 GenAI Code Security Report, which tested 100+ LLMs on 80 real-world tasks, found that AI-generated code introduces OWASP Top 10 vulnerabilities at a 45% rate, with Java reaching a 72% security failure rate. In Fortune 50 repositories, AI code added 10,000+ new security findings per month — a 10x increase between December 2024 and June 2025. Gartner projects a 2,500% rise in software defects by 2028 for organizations that bypass strong AI governance. The defining characteristic of AI security debt is that it is systematic, not accidental: it is baked into the adoption model itself when organizations deploy AI coding tools without corresponding security controls. ...

AI-generated code security statistics reveal a growing crisis: 42% of all code is now AI-generated or AI-assisted, yet only 12% of organizations apply the same security standards to it as traditional code. Across 8+ major studies, vulnerability rates range from 25% to 78% depending on methodology — but every study agrees the risk is real and getting worse. The Scale of the Problem: 42% of All Code Is Now AI-Generated AI-generated code security has become one of the most urgent challenges in software development because the scale of adoption has outpaced the security infrastructure built to handle it. According to the Sonar Developer Survey 2026, 42% of all code written today is either fully generated or significantly assisted by AI tools. GitHub Copilot alone has reached 26 million users, and 90% of Fortune 100 companies have adopted some form of AI coding assistant — numbers confirmed by GitHub’s own public data. The speed of adoption is remarkable: when GitHub Copilot launched in 2021, AI-assisted coding was a novelty. By 2026, writing code without AI assistance is the exception in most enterprise environments. Yet despite this ubiquity, only 12% of organizations apply the same security review standards to AI-generated code as they do to traditionally written code. That gap — between adoption speed and security readiness — is where the vulnerabilities accumulate. The Checkmarx Enterprise Survey 2026 found that 99% of development teams use AI for code generation, but only 18% have formal governance policies covering how that code gets reviewed, tested, and deployed. ...

Enterprise AI coding security guardrails are policy-enforced controls that intercept, validate, and restrict what AI coding assistants can receive, generate, and execute — protecting codebases from secrets leakage, vulnerable output, and regulatory exposure. Without them, your AI tooling is a liability waiting to activate. The AI Coding Security Crisis Every Enterprise Faces in 2026 Enterprise security teams in 2026 are confronting a compounding problem: AI coding assistants have become the fastest-growing attack surface in the software development lifecycle, yet most organizations have no systematic controls in place. GitGuardian’s 2025 State of Secrets Sprawl report found 28.65 million new hardcoded secrets in public GitHub commits — a 34% year-over-year jump, the largest single-year increase ever recorded. AI-assisted commits are disproportionately responsible: those commits leak secrets at a 3.2% rate, more than double the 1.5% baseline for human-only commits. Veracode’s 2025 analysis found that 45% of AI-generated code contains security vulnerabilities, with AI-generated code introducing 2.74x more vulnerabilities and 1.7x more total issues than human-written code. Despite this, Cycode’s State of Product Security for the AI Era 2026 report found that 81% of enterprises lack visibility into AI usage across their SDLC — even though 100% of those organizations already have AI-generated code in their codebases. The stakes are clear: without guardrails, AI coding tools amplify security debt faster than any team can remediate it. ...

Claude Code can find 500+ vulnerabilities in production codebases when configured with security-focused MCP servers like Semgrep and GitGuardian. The core insight: AI-generated code contains confirmed security vulnerabilities 25–62% of the time, which means you need AI to check AI’s output. Properly set up, Claude Code doesn’t just write code — it catches the security flaws it (and your team) would otherwise miss. Why Claude Code Changes Vulnerability Discovery Claude Code changes vulnerability discovery by combining static analysis, semantic understanding, and agentic remediation into a single workflow that traditional SAST tools cannot replicate. A traditional SAST scanner flags a pattern match and stops — it can’t understand the business logic context that determines whether that pattern is actually exploitable. Claude Code can reason about authorization flows, track data provenance across function calls, and identify logic flaws that only emerge at the intersection of multiple components. ...

DryRun Security is an AI-native SAST platform built specifically for teams shipping code with AI agents. Unlike traditional scanners that match patterns, it understands behavior — detecting logic-level flaws that Snyk, Semgrep, and CodeQL routinely miss. What Is DryRun Security? (AI-Native SAST for the Agentic Era) DryRun Security is an AI-powered Static Application Security Testing (SAST) platform designed from the ground up for agentic and AI-assisted coding workflows. Founded to address a specific failure mode — that traditional pattern-matching scanners cannot reason about code behavior, only code structure — DryRun built its Contextual Security Analysis (CSA) engine around large language models that understand intent, data flow, and business logic. In March 2026, DryRun published research showing 87% of AI agent pull requests (26 of 30 sampled) introduced at least one security vulnerability, and their CSA engine detected 88% of all seeded vulnerabilities in head-to-head testing — a figure that dropped below 40% for every competitor tested. DryRun earned a 4.9/5 rating on G2 and was named a High Performer in SAST in Spring 2026 G2 Reports. For teams running Claude Code, Cursor, or Windsurf, DryRun embeds directly into the IDE via its Code Insights MCP server, surfacing security findings before a PR is even opened. ...