Security
The security failure modes of AI-generated code: common vulnerability classes, slopsquatting and hallucinated packages, and prompt injection against coding agents.
How to use this collection
Use security when you need a bounded answer rather than a generic promise about AI coding. The 3 articles separate observed evidence, working assumptions, product boundaries, and decisions that still belong to a human reviewer. Each guide is dated and keeps its source limitations visible.
Start with “Security Vulnerabilities in AI Code” for the broadest entry point, then use “Prompt Injection Against Coding Agents” when you need the collection's more specific edge. The cards below state what each article covers, so you can choose by task instead of reading a manufactured sequence. Related links inside each guide connect methods, risks, evidence, and next actions without treating one check as universal proof.
Check each article's publication date, cited source, and stated scope before applying it to a live repository. Examples explain a method; they do not replace your project rules, threat model, tests, or accountable reviewer. If two guides appear to conflict, compare their assumptions and evidence rather than selecting the more confident wording.
Security
Security Vulnerabilities in AI Code
Veracode's 100+ LLMs: 45% introduced OWASP Top 10 flaws, XSS failed at 86%, Java at 72% - and security stayed flat across model generations. The classes, the causes, and a defense stack ordered deterministic-first.
Updated: July 2, 2026Read article →
Security
Slopsquatting
Attackers register the packages AI hallucinates - 19.7% of recommendations, 205k invented names, 43% repeating consistently. The mechanic, the USENIX 2025 numbers, and the defenses that close the install path.
Updated: July 17, 2026Read article →
Security
Prompt Injection Against Coding Agents
An agent reads a poisoned README and runs the attacker's instructions - OWASP's #1 LLM risk, with 2026 CVEs against Copilot, Claude Code and MCP servers. Why it may be structural, and why containment beats cure.
Updated: July 17, 2026Read article →
Want to see what your last agent run would have looked like?
Request access