This is the list the check runs against. It is public because the catalog is more useful to you than it is secret to us — and because you should be able to see exactly what is being looked for before you trust a result.
criticalThe lethal trifecta
One agent or request path combines untrusted input, access to private data, and the ability to communicate externally. Any two are usually fine; all three together mean an attacker who controls the input can exfiltrate the data.
Why agents do itAgents wire up whatever tools make the feature work. Nothing in the prompt asks them to notice that the combination is the vulnerability, so they connect a web-fetch tool, a database client, and an outbound HTTP call in the same handler without comment.
A study of 31,132 published AI agent skills found 26.1% contained at least one security vulnerability, including prompt injection, data exfiltration and privilege escalation.
criticalMissing authorization check
An endpoint authenticates the caller but never checks whether that caller is allowed to touch the specific record they asked for. Any logged-in user can read or modify anyone's data by changing an id.
Why agents do itAgents reliably implement 'is the user logged in' because it's a visible requirement. 'Is this user allowed this row' is invisible in the happy-path spec, so it gets skipped — and the feature still works perfectly in testing, because you test with your own data.
criticalSecrets written into code
API keys, tokens, connection strings or webhook signing secrets inlined into source, committed config, or a client-side bundle.
Why agents do itWhen an agent needs a value to make the code run, the shortest path to working code is to inline it. Agents also frequently place a genuinely secret key behind a client-visible env prefix because that's what made the import resolve.
criticalHallucinated or typosquatted dependency
The code imports a package that does not exist, or whose name is one character from the real one. Attackers register the names agents hallucinate most often and wait.
Why agents do itModels generate plausible package names from pattern, not from a registry lookup. The import reads perfectly and only fails at install — or worse, succeeds, because someone already registered the hallucinated name.
highUnescaped output (XSS)
User-controlled or model-generated content rendered as markup without escaping or sanitisation.
Why agents do itRendering raw HTML is how an agent makes rich content display correctly on the first try. Escaping breaks the visible result, so the agent removes it.
Veracode's Spring 2026 GenAI code security study tested 100+ models and found 86% of generated samples failed to defend against cross-site scripting.
Untrusted input written into logs unsanitised, letting an attacker forge log entries, break log parsing, or attack whatever downstream system reads the logs.
Why agents do itAgents add generous logging for debuggability and interpolate the request directly, because that's the most useful thing to print.
Veracode's Spring 2026 study found 88% of generated samples were vulnerable to log injection.
criticalUnparameterised query
User input concatenated into SQL, a raw query builder, or a NoSQL filter object.
Why agents do itAgents reach for string interpolation when a query needs to be dynamic — a variable table name, an optional filter, a sort column — because parameter binding doesn't cover those cases cleanly.
highWide-open CORS, RLS or bucket policy
An access boundary set to allow everything — `Access-Control-Allow-Origin: *` on a credentialed route, a `USING (true)` row-level policy, or a public storage bucket holding private files.
Why agents do itA permissions error is the fastest bug for an agent to make disappear, and the widest setting always makes it disappear. The feature works, so the change is never revisited.
highUnmetered expensive endpoint
A route that costs real money or real compute per call — model inference, email, SMS, image generation, export — reachable with no per-identity budget.
Why agents do itRate limiting is never part of the feature request, and its absence is invisible until the bill arrives. Agents build the capability, not the brake.
mediumSilently swallowed failure
A catch block that returns a success shape, an empty array, or a default — so a real failure looks identical to a legitimate empty result.
Why agents do itAgents are optimising for code that runs without crashing. Returning a safe default achieves that, and it hides exactly the failures you most need to see.
highPlaceholder or mock left in the shipped path
Sample data, a stubbed function, a hardcoded 'success', or a TODO sitting in code that now runs in production.
Why agents do itAgents scaffold with placeholders so the shape compiles and the UI renders, then build the next layer on top. The scaffold is only obviously wrong if you go back and look.
highUnvalidated path or redirect
A filename, path segment or redirect target taken from input and used without normalising — allowing `../` escapes or open redirects to attacker-controlled hosts.
Why agents do itThe agent implements the useful case (fetch the file the user named, return them where they came from) and treats the input as data rather than as a capability.
mediumSecurity lost across iterations
A check that existed in an earlier version is gone after several rounds of 'fix this' — the validation, the ownership filter or the escaping was dropped while solving an unrelated bug.
Why agents do itEach iteration rewrites for the goal in front of it. Protections added earlier aren't part of the current instruction, so they get refactored away without anyone noticing.
Published 2026 analysis of iterative AI code generation found security degrades across successive refinement rounds rather than improving.