Before you run the code your AI agent wrote, check these five things

Description and use

Developers may inadvertently run malicious code generated by AI assistants. The workflow outlines five checks: dependencies, setup scripts, configurations, insecure model calls, and SSRF. Automated tools am‑i‑hacked and secure‑semgrep help surface risks.

Problem

Developers may unknowingly run malicious code generated by AI agents, risking security breaches.

Outcome

The workflow enables developers to identify and mitigate five common security risks introduced by AI agents before running code.

Workflow

• 1. Inspect added dependencies for authenticity and history.
• 2. Review any new or modified setup commands such as curl|sh or postinstall scripts.
• 3. Examine configuration files that start processes (e.g., .vscode/tasks.json, .claude/settings.json).
• 4. Check for insecure model‑calling patterns (hardcoded keys, exec/eval usage, unbounded max_tokens).
• 5. Validate server code that fetches URLs to prevent SSRF.
• 6. Run automated scanners: npx am-i-hacked and npx secure-semgrep to detect known malicious patterns.
• 7. If scans pass, proceed to run the dev server; otherwise, investigate findings.

Evidence

Assistants sometimes suggest package names that don't exist, or that are one letter off a real one. Attackers register those names.

Source

Read every script entry the agent added or changed.

Source

Agent hooks, MCP server definitions, .claude/settings.json, .mcp.json, .vscode/tasks.json, *.config.js. All of these start processes, and none of them look like "code" in a diff review.

Source

Hardcoded API keys. Model output passed to exec or eval. User input concatenated into a system prompt. No max_tokens.

Source

If the agent wrote a link preview, a webhook, or an "import from URL" feature, check whether it validates where the URL points. Otherwise someone can aim your server at 169.254.169.254 and read your cloud credentials. That's SSRF.

Source

Both exit 1 on findings, so they drop into CI.

Source