We ran a session with Jordan Constantine, Head of Offensive Security at WorkNest Secure. Codacy CTO Kendrick Curtis covered what goes wrong while the code is being written; Jordan covered what he finds when he's paid to attack it afterwards.
4 vulnerability classes in AI-assisted development:
Insecure dependencies and malware. Agents are insecure by default on versions: stale training data means they pull outdated packages, and the corpus over-represents older versions because that's what people wrote examples against. Ask the LLM to remediate and it swings to bleeding edge instead, which is its own risk. Add slopsquatting to that — typosquatting, except the model makes the typo, at scale.
The single highest-return fix in the whole session: set a minimum age in your .npmrc. Most malicious packages get flagged and pulled within hours, so 3 days of insulation removes the large majority of bleeding-edge dependency risk. One config line. For the other end — known-vulnerable older versions — you need a version database, which is the part we do; Verity runs our CLI inside the agent and corrects the version before it lands.
Malicious MCP servers. An MCP server is a wrapper around an API, which means it's a middleman in your code path on the developer machine and in production. Same threat model as a malicious package: exfiltrate what's on the machine and post it out. The fix isn't banning them, it's a curated allowlist committed somewhere developers can actually find, a process for adding to it, and scoped tokens per server so the blast radius is contained when 1 turns out to be hostile.
