Blog

Claude Code and Cursor generate correct, functional code — but they were never designed to probe their own output for adversarial failure modes. This post covers the three LLM security gaps that vibe-coded features consistently miss: prompt injection, agent abuse, and RAG poisoning, with practical examples and a pre-ship checklist.

When an LLM has tools — API calls, file writes, database access — the attack surface grows beyond what the model says to what the model does. This post covers three core agent abuse patterns in 2026: tool call hijacking, memory poisoning, and multi-agent trust escalation, with concrete architectural defenses for each.

A complete technical guide to prompt injection for developers building LLM applications — covering direct injection, indirect injection via retrieved content, jailbreak techniques, real-world attack scenarios with code examples, detection methods, and the mitigation patterns that actually work in production.

Before you ship AI-generated code from tools like Lovable, Bolt, or v0, run through this security checklist to catch the top vulnerability classes that large language models consistently miss. Covers SQL injection, IDOR flaws, missing authentication, insecure direct object references, and hardcoded secrets — all common patterns in vibe-coded apps.

A quick-start guide to running Semgrep static analysis on AI-generated code — catch the security bugs that LLMs introduce before they hit production. This guide walks through installing Semgrep, running the default ruleset, and interpreting the results for the most common vulnerabilities found in vibe-coded applications using Cursor, Lovable, and Bolt.

AI-assisted coding moves fast — but speed without security scanning leaves serious exploitable holes in your application. Here is what every vibe coder needs to watch for: authentication bypasses, broken access controls, unvalidated inputs, exposed API keys, and missing rate limiting. These are the patterns that AI coding assistants generate most often and that attackers target first.