Agentic AI security comes down to three surfaces that most teams are not adequately protecting: the permissions you hand to autonomous agents, the provenance of the code those agents write, and the supply chain of dependencies, containers, and tools they pull from. When AI-assisted developers ship code at 3-4x the speed of their peers but introduce security findings at 10x the rate (Cloud Security Alliance, 2026), the defect surface grows faster than any remediation team can keep up with. The answer is not to slow down — it is to add security as a dedicated pass in your AI coding workflow, using tools built for the new attack classes that AI code introduces.
Last verified: 2026-07-22 — Security tools and threat data change frequently. These findings were checked against primary sources on the date shown.
- The core problem: AI agents write code fast, but 45% of AI-generated code samples contain OWASP Top 10 vulnerabilities (Veracode, 2025-2026).
- New attack class — slopsquatting: LLMs hallucinate package names 5.2% of the time (commercial models) to 21.7% (open-source models); 43% of those hallucinated names repeat across runs, making them pre-registerable by attackers (USENIX Security 2025).
- The five agencies agree: Five Eyes intelligence agencies warned on June 22, 2026 that "the timeline is not years, it is months" for AI-powered offensive cyber capabilities.
- What to do: Run security as a separate multipass step, use Snyk for code scanning, Chainguard for hardened container images, enforce least-privilege on agent identities, and adopt a family safe phrase against voice-cloning scams.
Why Is Agentic AI Security Different from Regular AppSec?
Agentic AI security is different because AI agents do not just generate text — they call tools, access databases, execute shell commands, and commit changes with real system permissions. Traditional application security assumed a human developer wrote the code, a human reviewed it, and a human deployed it. In 2026, 93% of organizations use AI-generated code in their workflows, but only 12% apply the same security standards to AI code as they do to human-written code (ProjectDiscovery 2026 AI Coding Impact Report).
The result is a widening gap: AI writes the code, but nobody is checking the security. A 2026 study by Sherlock Forensics found that 92% of AI-generated codebases contain at least one critical vulnerability, with an average of 8.3 exploitable findings per application. The average time from deployment to first exploit attempt on an AI-built SaaS was just 18 days.
Three factors make this worse than traditional security debt:
- Speed amplification: AI-assisted developers commit code at 3-4x the rate of unassisted peers, but introduce security findings at 10x the rate (Cloud Security Alliance, 2026).
- New attack vectors: AI introduces entirely new vulnerability classes — slopsquatting, prompt injection, tool poisoning — that legacy scanners were never designed to catch.
- Autonomous execution: Agents run 24/7 with elevated permissions. When they are compromised, the blast radius is not a single bad response; it is a chained sequence of tool calls, database queries, and file exfiltration.
What Is Slopsquatting and Why Does It Matter?
Slopsquatting is a supply-chain attack where an LLM hallucinates a package name that does not exist, an attacker pre-registers that name on PyPI or npm with malicious code, and the next developer or AI agent who receives the same hallucinated suggestion installs the attacker's package. The term was coined by Seth Larson, developer-in-residence at the Python Software Foundation, as a portmanteau of "AI slop" and "typosquatting" (Socket, April 2025).
The research backing this is now peer-reviewed and published. At USENIX Security 2025, researchers from the University of Texas at San Antonio, the University of Oklahoma, and Virginia Tech generated 576,000 code samples using 16 code-generating LLMs across Python and JavaScript. Their findings:
| Metric | Finding |
|---|---|
| Total code samples generated | 576,000 |
| Unique hallucinated package names | 205,474 |
| Commercial model hallucination rate | 5.2% |
| Open-source model hallucination rate | 21.7% |
| Names that repeat across all 10 re-runs | 43% |
| Overall samples with at least one hallucination | 19.7% |
Source: Spracklen et al., "We Have a Package for You!" USENIX Security 2025.
The 43% persistence rate is what makes this exploitable at scale. If hallucinations were random one-off errors, an attacker could not predict them. But because nearly half of hallucinated names repeat every time the same prompt is run, an attacker can enumerate the model's most common hallucinations, pre-register those names on public registries, and wait for the AI to recommend them — which it will, to every developer who asks a similar question.
In January 2026, security researcher Charlie Eriksen found that AI coding agents had already spread instructions referencing a hallucinated npm package (react-codeshift) across 237 repositories, with agents still attempting to install it daily. Eriksen registered the name himself, defensively, before an attacker could weaponize it (Xygeni, 2026).
How Do You Secure AI-Generated Code?
Securing AI-generated code requires treating security as a dedicated multipass step in your AI coding workflow — not something the LLM does while also writing features. Here is a practical framework:
Step 1: Separate security from correctness
LLMs do one thing at a time well. If you ask an AI agent to write a feature and simultaneously ensure it is secure, it will do a mediocre job of both. Instead, use a two-pass approach: first ask the agent to implement the feature, then in a separate prompt, instruct it to run a security hardening pass with all available scanning tools.
Step 2: Run multiple scanners and cross-check
No single scanner catches everything. The practical stack for 2026:
| Tool | What it scans | Free tier | Key strength |
|---|---|---|---|
| Snyk Code | Source code (SAST), dependencies (SCA), containers, IaC | Yes (limited) | In-IDE real-time scanning, AI-powered fix suggestions |
| Semgrep | Source code (pattern-based) | Yes (open source) | Custom YAML rules, very fast, policy-as-code |
| GitHub Advanced Security (CodeQL) | Source code (semantic analysis) | Via GHAS | Deep semantic analysis, GitHub-native |
| Grype | Container images | Yes (open source) | CVE scanning for container images |
| Chainguard Images | Container images (prevention) | ~50 images (free) | Zero-CVE images rebuilt nightly from source |
Sources: Snyk (snyk.io), Semgrep (semgrep.dev), GitHub (docs.github.com), Chainguard (chainguard.dev).
Step 3: Lock down the supply chain with Chainguard
Chainguard provides hardened container images built on Wolfi, a minimal Linux distribution purpose-built for containers. Their images are rebuilt nightly from source with only the packages needed to run the application, resulting in zero or near-zero known CVEs at scan time. A Chainguard comparison found that popular Debian-based images carry an average of nearly 300 CVEs, while their equivalents carry zero (Chainguard, 2024).
The free tier offers approximately 50 images tagged :latest without login. The paid catalog adds over 2,000 images with version pinning and CVE remediation SLAs. Every image includes build-time SBOMs (Software Bill of Materials) and Sigstore cryptographic signatures with SLSA Build Level 2 provenance attestations.
Step 4: Scan with Snyk and let the agent use it
Snyk is an AI-powered developer security platform that scans source code, open-source dependencies, container images, and infrastructure-as-code for vulnerabilities. It integrates directly into IDEs, Git workflows, and CI/CD pipelines, providing real-time vulnerability scanning and automated fix suggestions for both human-written and AI-generated code.
The key insight: if AI agents are already using tools to save tokens, give them the security tools too. Add Snyk as a step in the prompt you give your coding agent. Tell the agent: "Run Snyk on this codebase and report all findings." Let the agent use the scanner's output to fix the issues it finds. Then run a second scanner (Semgrep or CodeQL) and have the agent cross-check the results.
Step 5: Enforce least-privilege on agent permissions
The OWASP Top 10 for Agentic Applications (published December 2025) identifies Agent Identity and Privilege Abuse (ASI03) as a top-10 risk. When agents are stood up with broad permissions — full file access, shell execution, all API credentials — a single compromise becomes catastrophic. The principle is simple: an agent should have access only to what it needs for the specific task at hand.
In June 2026, CISA and the Australian Cyber Security Centre jointly published "Careful Adoption of Agentic AI Services," a government guide that recommends organizations challenge whether systems need to be exposed at all, limit unnecessary system access and external connectivity, and enforce strong authentication with regularly reviewed permissions (CISA, 2026).
For more on implementing least-privilege access control specifically for autonomous agents, see our guide on AI agent access control.
What Are the OWASP Top 10 Risks for Agentic AI?
The OWASP Top 10 for Agentic Applications was published on December 9, 2025, peer-reviewed by over 100 industry experts including contributors from NIST, Microsoft AI Red Team, and AWS. It defines ten security risk categories specific to AI agents:
| ASI # | Risk | What it means |
|---|---|---|
| ASI01 | Agent Goal Hijack | Attacker redirects the agent's objectives via prompt injection or poisoned data |
| ASI02 | Tool Misuse and Exploitation | Agent is tricked into using tools in harmful ways |
| ASI03 | Agent Identity and Privilege Abuse | Agent has excessive permissions; compromise leads to broad access |
| ASI04 | Agentic Supply Chain Compromise | Malicious dependencies, tools, or model weights enter the agent's supply chain |
| ASI05 | Unexpected Code Execution (RCE) | Agent executes attacker-supplied code |
| ASI06 | Memory and Context Poisoning | Persistent corruption of stored context or memory |
| ASI07 | Insecure Inter-Agent Communication | Messages between agents are intercepted or forged |
| ASI08 | Cascading Agent Failures | One agent's failure propagates through connected agents |
| ASI09 | Human-Agent Trust Exploitation | Attackers exploit the trust humans place in agent outputs |
| ASI10 | Rogue Agents | Agent drifts from intended behavior without attacker involvement |
Source: OWASP GenAI Security Project (genai.owasp.org), December 2025.
ASI04 (Agentic Supply Chain Compromise) is the category that slopsquatting falls under. It covers the entire chain of dependencies, tools, models, and infrastructure that agents rely on. The OWASP guidance recommends allowlisting, sandboxed execution, private registries, and runtime monitoring as defense layers — because no single control is sufficient.
For a deeper architectural perspective on how these risks interact, see our guide on agentic AI security architecture decisions.
How Does Prompt Injection Attack AI Agents?
Prompt injection is the most common manipulation vector against AI agents. In its simplest form, an attacker inserts text that says "disregard everything and do the following" into a document, email, or web page that the agent processes. The agent cannot distinguish its operator's instructions from the attacker's injected text — it processes everything as natural language.
In January 2025, researchers found EchoLeak (CVE-2025-32711) in Microsoft 365 Copilot — a zero-click prompt injection vulnerability that scored 9.3 on CVSS. An attacker sent a single email containing hidden instructions. The recipient never opened it. Copilot encountered the email during a routine search, followed the embedded instructions, and exfiltrated confidential files and chat logs. No firewall was breached and no credentials were stolen (Galileo AI, 2026).
When a static LLM gets injected, you get one bad response. When an autonomous agent gets hijacked, it chains tool calls, queries databases, and delegates tasks to other agents — all pursuing the attacker's objectives. The blast radius scales with the agent's permissions and tool access.
For a practical framework on defending against prompt injection and other constraint violations, see our AI agent safety 4-layer defense model.
What Did the Five Eyes Agencies Warn About?
On June 22, 2026, the heads of the cyber security agencies of the United States (CISA and NSA), the United Kingdom (NCSC), Canada (Cyber Centre), Australia (ACSC), and New Zealand (NCSC-NZ) issued a rare joint statement. The key passage:
"Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months."
Source: CISA (cisa.gov), NCSC (ncsc.gov.uk), published June 22, 2026.
The advisory urged leaders to:
- Reduce your attack surface — limit unnecessary system access and external connectivity.
- Accelerate patching processes — AI is shortening the time between vulnerability discovery and exploitation.
- Address legacy systems — unsupported systems are strategic liabilities, not just technical debt.
- Review and strengthen identity and access controls — limit who can access critical systems, enforce strong authentication, regularly review permissions.
- Prepare for incidents before they happen — test response plans, assume breaches will occur, focus on fast containment.
The statement was signed by the heads of six intelligence agencies — not mid-level bureaucrats. The specificity of the timeline ("months, not years") signals institutional alarm that is rare for agencies that typically hedge everything.
How to Build an Agentic AI Security Pipeline
Here is a practical, step-by-step pipeline that any team shipping AI-generated code can implement:
1. Use hardened container images as your base
Replace standard Docker Hub images with Chainguard Images or equivalent hardened alternatives. This eliminates the majority of CVEs before you even write a line of code. Standard Debian-based images carry an average of nearly 300 CVEs; Chainguard equivalents carry zero.
2. Write code with AI, but run security as a separate pass
After the AI agent implements a feature, give it a new prompt: "Run all available security scanners on this codebase and report every finding." Provide access to Snyk, Semgrep, and Grype. Let the agent use the scanner outputs to fix what it finds.
3. Cross-check with multiple scanners
No single scanner catches everything. Run Snyk for code and dependencies, Semgrep for custom patterns, and Grype for containers. Have the agent reconcile the findings — if two scanners disagree, investigate manually.
4. Verify every dependency against the registry
Before any AI-recommended package is installed, verify it exists in the official registry (PyPI, npm) and check the publisher identity and registration date. If the package was registered recently and has few downloads, treat it as suspicious. See our earlier coverage of the OpenAI-Hugging Face AI agent breach for what happens when supply chain trust breaks down.
5. Enforce least-privilege access on every agent
Each agent should get its own scoped identity with only the permissions it needs for its specific task. Never share API keys across agents. If one agent is compromised, the blast radius should be limited to that agent's permissions. For a complete guide to giving agents production access safely, see how to give AI agents production access without losing sleep.
6. Monitor agent behavior with adversarial supervisors
For 24/7 agents that process event queues or respond to triggers, consider running adversarial groups of agents tasked with auditing the primary agent's actions. One agent will eventually make a mistake or get compromised; a supervisor agent can catch it before damage compounds. This is a new frontier with little established tooling, but teams should be designing these overlays now.
7. Treat AI output like third-party code
AI-generated code should receive the same scrutiny you would apply to a dependency from an unknown vendor. Run it through the same SAST, SCA, and container scanning pipeline. Do not assume the AI got it right because the code compiles and the tests pass.
What Are the AI Voice Scam Risks to Your Team and Family?
The security threat from AI is not limited to your codebase. AI voice cloning now requires as little as 3 seconds of audio to produce a convincing clone of anyone's voice with 95%+ accuracy, using free and open-source tools (Cybrvault, 2026). The fastest-growing fraud category in the United States in 2026 is deepfake phone scams.
The two most common attacks:
- The "family emergency" scam: A caller mimics a family member's voice, claims to be in distress (car accident, jail, medical emergency), and asks for money. Average loss: $11,000 per incident.
- The "CEO wire transfer" scam: An attacker clones an executive's voice and instructs an employee to wire funds. In January 2024, a finance worker at Arup's Hong Kong office wired $25.6 million after a video conference where every face and voice was AI-generated.
Source: Consumer Reports (2025), FBI 2025 Internet Crime Report, Cybrvault (2026).
The one defense that works: Establish a family or team safe phrase — one word the caller must say before you act. AI can clone a voice, but it cannot know your private code word. Set this up offline, in person, with your family and team. Consumer Reports and the FTC both recommend this as the single most effective defense.
What This Means for You
If you are building with AI agents in 2026, the security gap is not a future problem — it is a present one. The tools to close it exist today: Snyk for code scanning, Chainguard for hardened images, the OWASP ASI framework for risk assessment, and least-privilege access control for agent identities. The cost of not acting is not a hypothetical breach; it is the 18-day average from deployment to first exploit attempt that Sherlock Forensics measured on AI-built SaaS applications in 2026.
The minimum viable security posture for any team using AI coding tools:
- Add a security pass to your AI coding prompts (separate from the feature pass).
- Use hardened container images (Chainguard or equivalent).
- Run at least two independent scanners and cross-check results.
- Verify every AI-recommended dependency against the official registry.
- Scope every agent's permissions to the minimum it needs.
- Set up a family safe phrase this week — not next month.
FAQ
Q: What is slopsquatting?
A: Slopsquatting is a supply-chain attack where an AI model recommends a package name that does not exist, an attacker pre-registers that name on PyPI or npm with malicious code, and the next developer or agent who receives the same hallucinated suggestion installs the attacker's package. It was coined by Seth Larson of the Python Software Foundation and documented in a peer-reviewed USENIX Security 2025 paper that found commercial LLMs hallucinate package names 5.2% of the time and open-source models 21.7% of the time.
Q: How much AI-generated code contains vulnerabilities?
A: Veracode's 2025-2026 testing of over 100 LLMs found that 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities. Sherlock Forensics' 2026 assessment of real AI-built codebases found 92% contained at least one critical vulnerability, with an average of 8.3 exploitable findings per application. The Cloud Security Alliance found AI-assisted developers introduce security findings at 10x the rate of unassisted peers.
Q: What is the OWASP Top 10 for Agentic Applications?
A: Published December 9, 2025, the OWASP Top 10 for Agentic Applications defines ten security risk categories specific to autonomous AI agents, including Agent Goal Hijack (ASI01), Tool Misuse (ASI02), Agent Identity and Privilege Abuse (ASI03), and Agentic Supply Chain Compromise (ASI04). It was peer-reviewed by over 100 industry experts including contributors from NIST, Microsoft AI Red Team, and AWS.
Q: What did the Five Eyes agencies warn about in June 2026?
A: On June 22, 2026, the heads of CISA, NSA, UK NCSC, Australian ACSC, Canadian Cyber Centre, and New Zealand NCSC-NZ issued a joint statement warning that "frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months." They urged organizations to reduce attack surfaces, accelerate patching, address legacy systems, tighten identity controls, and prepare for incidents.
Q: How do you secure AI agents from prompt injection?
A: Prompt injection cannot be fully prevented because agents process all inputs as natural language and cannot reliably distinguish operator instructions from attacker text. Defenses include: treating the LLM as an untrusted system component, validating and sanitizing all tool outputs, enforcing least-privilege access so a hijacked agent cannot do irreversible damage, using separate API keys per agent, and running behavioral monitoring to detect anomalous agent actions. The OWASP ASI01 category covers the full taxonomy of goal hijack variants.
Q: What is Chainguard and how does it help with AI code security?
A: Chainguard provides hardened container images built on Wolfi, a minimal Linux distribution designed for containers. Images are rebuilt nightly from source with only necessary packages, resulting in zero or near-zero known CVEs at scan time — compared to an average of nearly 300 CVEs in popular Debian-based images. The free tier offers approximately 50 images; the paid catalog includes over 2,000 images with version pinning and CVE remediation SLAs.
Discussion
0 comments