Codacy

Most malicious npm packages get flagged within hours, so a three-day minimum age in your .npmrc removes roughly 95% of bleeding-edge dependency risk. That's one of four AI-assisted development vulnerabilities Kendrick Curtis (CTO, Codacy) works through here. Jordan Constantine (Head of Offensive Security, WorkNest Secure) then shows the attacker's side: a chatbot that gave up 60,000 user records and MD5 password hashes, and an AWS document ingestion service talked into leaking its own credentials. TOOLS Codacy — code quality and security scanning, free to start: https://codacy.com/sign-up Verity — agentic code review that self-corrects inside your AI agent: https://verity.md WorkNest Secure — penetration testing and red team: https://worknest.com/ CHAPTERS 0:19 What Codacy covers: DAST, containers, secrets, coverage, clean code 0:57 Jordan Constantine: pentesting, red team, social engineering 2:15 The four critical vulnerabilities in AI-assisted development 2:38 #1 Insecure dependencies and malware: insecure by default 3:36 npm malware: poisoned packages hunting your credentials 3:53 Slopsquatting: typosquatting at AI speed and scale 6:46 Verity: self-correcting the agent to a secure version 7:54 #2 Malicious MCP servers: what an MCP server actually is 10:44 #3 Prompt injection: hacking computers in English 13:55 #4 Unbounded agent permissions: agents execute as you 18:32 AI on the attacker’s side: prompt injection tops the findings 19:24 Why social engineering skills transfer to hacking systems 20:19 The CISO problem is speed and scale, not complexity 21:11 Guardrails: the naive "ignore previous instructions" 26:24 Walkthrough 1: which database tables can the chatbot reach? 28:35 Walkthrough 2: SSRF via an AWS document ingestion service 31:16 What to do differently: treat AI like infrastructure 32:27 Human in the loop for payments, permissions, sensitive data 33:56 Q&A 34:17 Do AI SOC tools respond fast enough to matter? 36:15 Which AI vulnerability is hardest to catch in review? 37:31 Custom review instructions and AI PR review 38:05 Real-time guardrails to stop an agent deviating? 38:43 Assume guardrails fail: the WAF and Cloudflare analogy 39:41 Filtering input before it reaches the agent 40:56 Securing AI-written code across PRs, pipelines and CI/CD 41:30 Why leaked CI/CD credentials beat a compromised laptop 42:04 Reviewing AI-generated code for cognitive bias #AISecurity #DevSecOps #PromptInjection #AppSec #MCP #SupplyChainSecurity #PenetrationTesting #CodeQuality #AICodeReview #CodeSecurity

Container Image Scanning is now available on Codacy. Run daily CVE scans on container images without standing up new tools or infrastructure, and see the results directly in the Codacy Security and Risk Management dashboard.