OWASP Cheat Sheet Series: Secure Coding with AI Cheat Sheet

# Secure Coding with AI Cheat Sheet

## Introduction

AI coding tools have moved beyond code suggestion. In 2026, agentic coding tools (Claude Code, Cursor agent mode, Aider, Devin, Copilot Workspace, Codex) execute shell commands, install packages, edit files, run tests, access the network, and push branches autonomously. Many developers run these agents with auto-accept enabled, meaning the agent operates with the developer's full permissions and minimal human oversight.

This cheat sheet addresses the security risks specific to AI-assisted and agentic coding. It focuses on threats that do not exist in traditional development workflows and does not restate general secure coding guidance already covered elsewhere.

For general secure coding, see the [Secure Coding Practices Quick Reference Guide](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/). For AI agent security beyond coding tools, see the [AI Agent Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html). For prompt injection prevention, see the [LLM Prompt Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html). For MCP protocol security, see the [MCP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html).

## Threat Model and Trust Boundaries

AI coding agents operate across multiple trust boundaries. Understanding these boundaries is essential before applying any controls.

```
                    TRUST BOUNDARIES IN AGENTIC CODING

 [DEVELOPER]                    [AGENT]                    [EXTERNAL]
  Developer  ──── permissions ──── AI Agent  ──── reads ──── Repo Content
  approves        (often full       executes       ingests     (issues, PRs,
  or auto-        dev access)       commands       context     READMEs, deps,
  accepts                                                      changelogs)
      |                |                |                |
      |           [MODEL PROVIDER]      |          [MCP SERVERS]
      |            API calls            |           Tool calls
      |            Code + context       |           File access
      |            sent to provider     |           Network access
      |                                 |           Credentials
      |                                 |
      |              [CI/CD]            |
      |            Workflows            |
      |            Org secrets          |
      |            Deploy access        |
```

### Threat Actors and Attack Surfaces

- **Repository content as instruction source.** Issue bodies, PR descriptions, PR comments, README files, dependency changelogs, error traces, fetched web pages, and MCP tool responses all become instructions when the agent reads them. An attacker who can write to any of these can influence agent behaviour.
- **MCP servers as tool providers.** Agents connect to MCP servers to access tools. A malicious or compromised MCP server can poison tool descriptions, shadow legitimate tool names, exfiltrate credentials through tool arguments, or update tool definitions after initial approval (rug-pull).
- **Rules files as persistent steering.** Files like `.cursorrules`, `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`, and `.windsurfrules` silently steer every future generation. They can be modified by a malicious PR or by the agent itself to embed persistent instructions.
- **The agent itself.** Agents running with auto-accept and full developer permissions can install packages, write to any file, execute shell commands, modify CI configuration, and push branches. A compromised agent context has the same blast radius as a compromised developer workstation.
- **CI/CD agents.** Review bots and CI runners (e.g. `claude-code-action`, Copilot review) act on PR content with access to org secrets. A malicious PR can trigger the CI agent to exfiltrate secrets or modify the build pipeline. This is confused deputy at scale.

## Section 1: Hallucinated Dependencies

AI coding assistants frequently suggest package names that do not exist on public registries. Attackers monitor these hallucinated names and register malicious packages with matching names (AI-assisted typosquatting).

### Do

- Verify every AI-suggested package exists on the public registry before installing. Check the package page, download count, maintainer history, and creation date.
- Be suspicious of packages with very low download counts, recent creation dates (less than 30 days), or a single maintainer with no other packages.
- Implement a pre-install hook or CI check that blocks installation of packages below a minimum age threshold.
- Maintain an internal allowlist of approved packages for your organisation.

### Don't

- Blindly run `npm install`, `pip install`, or `go get` with package names suggested by an AI without verification.
- Assume that because an AI suggested a package, it exists or is safe.
- Ignore typosquatting risk. AI assistants frequently suggest names that are close to real packages but slightly different.

## Section 2: Outdated Dependencies with Known CVEs

AI models are trained on historical code. They frequently suggest dependency versions that were current during training but now have known vulnerabilities. The AI may not know about CVEs published after its training cutoff or after the coding tool's last security-index update.

### Do

- Run dependency auditing tools (npm audit, pip audit, govulncheck, cargo audit) on every AI-generated dependency list before merging.
- Configure CI/CD pipelines to fail on known vulnerabilities in dependencies, regardless of whether the code was human-written or AI-generated.
- Pin dependencies to specific versions and update them through your normal dependency management process, not through AI suggestions.
- Cross-reference AI-suggested versions against vulnerability databases (NVD, GitHub Advisory Database, OSV).

### Don't

- Accept AI-suggested dependency versions without checking for known CVEs.
- Assume that AI assistants are aware of recent vulnerability disclosures.
- Disable dependency auditing for AI-generated code.

## Section 3: Indirect Prompt Injection in the Development Loop

Agentic coding tools ingest context from the repository, the network, and connected tools. Any content the agent reads can contain hidden instructions that alter its behaviour. This is indirect prompt injection applied to the development workflow.

### Attack Vectors

- **Issue bodies and PR descriptions.** An attacker opens an issue containing hidden instructions. When a developer asks the agent to "fix issue #123", the agent reads the issue body and follows the embedded instructions.
- **PR comments and review feedback.** Malicious review comments can instruct the agent to modify unrelated files, weaken security controls, or exfiltrate code when the developer asks the agent to "address