Vibe Coding Security: How to Stop AI Agents From Shipping Vulnerable Code
AI coding agents trust what they find — in the registry, on the machine, in the context window — often without verifying any of it. That trust is the new attack surface.
AI coding agents are writing production code at a pace no security team anticipated. When an engineer describes what they want and an agent generates the implementation, that workflow is called vibe coding. The security challenge is that these agents trust what they find — in the registry, on the machine, in the context window — often without verifying any of it.
Neatsun Ziv, co-founder and CEO of OX Security, has watched this attack surface expand firsthand. On episode 91, he explained how typo-squatting — a technique that has existed for years in package registries — now works against AI coding environments with alarming effectiveness.
What vibe coding security means
Vibe coding is describing desired functionality to an AI agent and letting it generate the code. Tools like Cursor and Copilot have made this the default workflow for a growing number of developers. Vibe coding security covers everything required to ensure that AI-generated code doesn’t introduce vulnerabilities, trust the wrong dependencies, or ship without proper constraints. The challenge is fundamental: traditional tools scan code after it’s written, but vibe coding security needs to operate before and during generation, because by the time the code exists, the trust decisions have already been made.
When AI agents trust too much
AI coding agents run on a simple trust model: if a package is in the registry, if a file exists on the machine, if a pattern appears in the training data, the agent treats it as legitimate. It doesn’t verify the provenance of packages it installs or question whether a config was placed by a developer or an attacker. The parallel to traditional security is clear — just as perimeter security fails when internal trust assumptions are wrong, agent-based development fails when the agent trusts everything in its environment without verification.
Typo-squatting meets AI
Typo-squatting isn’t new — attackers have published packages named like popular libraries (reqeusts for requests) for years. What’s new is how effectively it works against agents. Ziv describes what OX found: “You just go to GitHub and you publish the equivalent of a typo-squatting… you’re actually adding a command that one of the famous vibe coding environments just treats as, ‘If it’s on the machine, then I’m fine with that.’ Then you can instruct it to actually write malware locally that takes everything from the machine and just uploads it.”
The chain works because of two compounding trust assumptions: the developer trusts the AI environment because it’s productive, and the environment trusts the machine and registry because it has no provenance verification. When an attacker places a typo-squatted package on the machine, the agent installs it without question — and it executes with the same permissions as the development environment, which typically has access to source code, credentials, and internal services.
Why defenders pay more
Beyond specific vectors, AI creates a cost asymmetry. Ziv explains: “You can actually say, take my code and scramble it so it won’t look the same. It would cost you a few tokens… it’s like $10.” The defender’s burden is vastly larger — scanning all generated code with AI costs far more than the attacker spent to obfuscate. Naive AI-powered scanning of everything is economically unsustainable.
| Role | Token cost | Coverage |
|---|---|---|
| Attacker | Low (obfuscation, typo-squatting) | Targeted, one exploit |
| Defender (naive scanning) | Very high (scan everything with AI) | Broad, mostly clean code |
| Defender (context-first) | Moderate (patterns + periodic deep scan) | Focused on edge cases |
Ziv’s balanced approach: “Most of the time I’m going to do pattern-based scanning. Periodically, I’m going to do a deep scan” — using AI only for edge cases and to prefabricate patterns.
How to secure your AI coding workflow
- Lock your dependency sources. Restrict agents to verified registries and pinned versions. If the agent can’t install arbitrary packages, typo-squatting loses its primary vector.
- Load security context before generation. Feed the agent which APIs are external, which databases the service touches, and which sanitization rules apply — the same context-first approach that fixes shift-left.
- Verify generated code with context-aware scanning. Pattern-based as the baseline; reserve expensive AI deep scans for edge cases and new code paths.
- Enforce authorization boundaries on agent actions. Limit which files it can modify, which secrets it can access, which services it can call — least privilege for agents.
- Audit the trust chain regularly. Anything the agent trusts without verification — local packages, registry sources, cached models, config files — is a potential attack vector.
No single tool solves this. A context-aware approach — the same discipline behind our product security work — significantly reduces the risk.