Security Guide for the AI Coding Era

Developers who use AI coding assistants write code faster — and ship more security vulnerabilities while feeling more confident their code is safe. This is the AI security paradox, and it is the starting point for everything in this guide.

AI tools like Claude Code can now explore your full codebase — reading files, grepping for symbols, and tracing dependencies across modules. But capability isn't the same as guarantee. They may not proactively audit every security implication unless prompted, their suggestions still reflect patterns common in training data (which skew permissive), and they can occasionally hallucinate package names that attackers have pre-registered with malicious payloads. The gap isn't visibility anymore — it's judgment about what to verify and when. Understanding where that judgment falls short is what lets you catch issues before they ship.

This guide covers three distinct threat surfaces:

• AI coding agents (Copilot, Cursor, Claude Code) — the security vulnerabilities these tools consistently introduce into your codebase
• AI features (chatbots, document Q&A, RAG pipelines) — attacks that are unique to applications running LLMs at runtime
• AI agents (tools connected to an LLM that take autonomous actions) — the risks that arise when AI can read files, send emails, or modify infrastructure

General web security (SQL injection, XSS, CORS, authentication) is covered in a companion OWASP guide. This guide focuses on what is new and different in the AI era.

How to Read This Guide#

• Complete beginners: Read all chapters in order. Chapter 1 builds the mental model that the rest of the guide depends on.
• Developers who already use AI coding tools: Skim Chapter 1 for key term definitions, then go directly to Chapters 2–4.
• Building an AI-powered app: Chapters 3 and 4 are your priority, with Chapter 5 as your practical takeaway.

🎬 Video Course#

We also have a YouTube channel! There is a dedicated playlist covering AI security topics — if you prefer learning by watching, you can quickly get up to speed on the key concepts from this guide through these videos:

Learning Path#

Three Threat Surfaces at a Glance#

The cards below introduce one representative vulnerability from each of the guide's three domains. Each chapter goes deeper with more examples, root-cause analysis, and mitigations.

OWASP LLM Top 10: 2025#

The OWASP Top 10 for LLM Applications is the threat taxonomy specifically for AI-powered applications. Chapter 3 covers the threats that target your deployed LLM features; Chapter 4 covers the agent-specific entries.

Chapters#

Chapter 1 · The AI Security Paradox#

Topics covered:

• The Trust Trap — why code that compiles cleanly is not the same as code that is secure
• AI coding agents vs. AI features vs. AI agents — three things that sound similar but carry different risks

Chapter 2 · Security Mistakes Made by AI Coding Agents#

Topics covered:

• Common vulnerability patterns: missing input validation, SQL injection via string concatenation, hardcoded credentials, insecure cryptography, XSS
• Context blindness and unprotected routes — AI generates endpoints without checking for your existing authentication middleware unless prompted
• Over-permissive configurations — why AI defaults to * CORS, wildcard IAM policies, and 0.0.0.0 bindings
• Deprecated libraries and slopsquatting — how AI-hallucinated package names become an attack vector
• Secret leakage from context windows — how .env files end up committed to version control
• Prompt injection targeting your IDE — malicious instructions embedded in repository files
• Insecure test code — disabled authentication, mocked cryptography, and silently removed assertions

Chapter 3 · AI and LLM-Specific Threats#

Topics covered:

• Prompt injection (direct and indirect) — and why "don't follow user instructions" is not a reliable defense
• Improper output handling — when AI output flows into HTML, SQL, or code execution sinks
• System prompt leakage — protecting your AI's hidden instructions (and why secrets must never be stored there)
• Sensitive information disclosure — context window leakage and training data memorization
• Denial of Wallet — how attackers trigger massive AI API costs without taking your service offline
• Vector and embedding weaknesses — retrieval poisoning and embedding inversion in RAG systems

Chapter 4 · AI Agent Security#

Topics covered:

• Excessive agency and the Principle of Least Privilege — auditing an agent's tool list
• Human-in-the-loop controls — a risk-based framework for deciding which actions require human confirmation
• Multi-agent trust — authenticating inter-agent communication in AI pipelines
• Context isolation — keeping users' data separate in multi-user agentic systems
• Monitoring and observability — what to log, what not to log, and early warning signals for abuse

Chapter 5 · The AI-Safe Developer Checklist#