An AI-coding-agent MVP isn't automatically less secure — it's just audited less, since founders review output for correctness, not exposed secrets or missing auth. Before real users or payments touch it, run five checks: secrets, route auth, dependency provenance, agent-config integrity, and a human read of anything touching money or personal data.
By mid-2026, the conversation on Hacker News has shifted. Fewer threads about demo speed, more about trust, security, and stack stability. That shift tracks a real pattern: AI coding agents write fast, plausible code — and plausible is not the same as safe. "Agentjacking" attacks that trick Cursor and Claude Code into running malicious instructions are now a documented technique, not a hypothetical. Compromised maintainer accounts have pushed backdoors that hook into agent configuration files, giving malware a foothold that persists across sessions.
What is agentjacking, and why does it matter for a founder?
Agentjacking tricks an AI coding agent into executing attacker instructions hidden inside content the agent trusts — a README, a dependency's config file, a code comment. The agent can't always tell the difference between an instruction from you and an instruction embedded in a file it just read. Reported cases in 2026 include compromised package maintainer accounts pushing backdoors through agent config files, and a browser-extension vulnerability where a co-installed extension could silently trigger an AI coding agent's pre-approved tasks.
The founder-relevant version: if your agent has shell access, API keys in its environment, or write access to your repo, a prompt-injected instruction can act with those same permissions. The agent doesn't need to be malicious. It needs to be tricked once.
What should you audit before an AI-agent-built MVP goes live?
Five checks, in order of how often we find them missing on a first review:
| Check | What it catches | Minimum fix |
|---|---|---|
| Secrets in the repo | API keys, DB credentials committed in plain text (a common agent default) | git log -p scan + rotate any key that ever appeared in a commit |
| Auth on every route | Endpoints the agent built for a demo and never gated | List every route, confirm an auth check on each one that touches user data |
| Dependency provenance | A package pulled in by the agent with no one checking who maintains it | Pin versions, run npm audit / equivalent, review anything added in the last 90 days |
| Agent-config integrity | .cursor/, CLAUDE.md, MCP server configs modified by something other than you | Diff agent config files against your last known-good commit before every deploy |
| Human read of money/data paths | Payments, auth, and PII handling the agent wrote without anyone reading line-by-line | One senior engineer reads every line touching Stripe, auth, or personal data — no exceptions |
None of these require distrusting the tool. They require treating agent output the way you'd treat a first-time contractor's pull request: reviewed, not rubber-stamped.
Is AI-generated code inherently less secure than human-written code?
Not inherently — the vulnerability classes are the same ones that predate AI coding tools by decades. What's different is the review gap. In 2025, 25% of YC W25 startups reported that 95% or more of their codebase was AI-generated; by 2026 that share is higher. Code volume rose faster than review discipline did. An agent will confidently write an unauthenticated admin route if the prompt didn't specify otherwise — a human contractor is more likely to ask.
The gap closes with process, not by writing less AI-generated code. Treat every agent session's output as a PR from a fast, literal, context-limited junior engineer: reviewed before merge, tested before deploy, never trusted with production secrets by default.
What do we check by default before a build goes live?
We run the five-item audit above on every codebase before launch, agent-written or not — it costs an afternoon and it is non-negotiable. Payments, auth, and any endpoint touching personal data get a second engineer's read, independent of who or what wrote the first draft. We don't ship an agent-written auth layer without a human confirming what it actually gates.
We cover the broader build-vs-hire decision — when vibe coding is the right call and when it isn't — in vibe coding vs. hiring a developer. The security audit above applies either way, once real users show up.
The one-sentence rule
An AI agent will write code that runs. It will not tell you what it forgot to lock down — that's still your job, or your reviewer's.
Written 2026-07-31 by Abhiraj Sakargaye.