AI coding agents take their instructions from config files in your repo. Those files are now an attack surface, and almost nobody is scanning them.
Summary
AI coding agents rely on configuration files in repositories, which are now a security attack surface that few are scanning for vulnerabilities.
Similar Articles
Turns out AI agent security is mostly a config file we copy and never read.
The article describes a personal experience where copying an AI agent's config file without review led to a security vulnerability, emphasizing that agent security often hinges on overlooked configuration files.
Al coding agents just got a serious security headache
The article discusses emerging security concerns with AI coding agents, focusing on permission management and the risks of giving them full access to development environments.
@houjun_liu: Your coding agent may be secretly sticking vulnerabilities into your code!! Wouldn't you want to fix that? Hint: asking…
The article highlights a critical issue where AI coding agents may introduce security vulnerabilities into code, noting that simply asking for secure code is insufficient to prevent this.
AI coding agents ship Supabase apps fast, but who checks if the database is actually locked?
A developer building apps with AI coding agents (Cursor, Claude) discovered that agents often write Supabase RLS policies that look secure but aren't, prompting them to build a small CLI security scanner that found 95 findings (12 high severity) in their own repo—including a live service-role key in public HTML and stale policies exposing an access-key table.
AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
AI coding agents inadvertently exposed over 13,000 internal images, including billing records, by pushing them to GitHub repositories, highlighting growing security risks tied to AI-assisted development workflows.