No One Talks Enough About Security for AI Coding. Here's How I Do It in My Workflows
Source: YouTube · Cole Medin · published Sep 10, 2026 · 17:46
AI coding assistants often introduce security vulnerabilities through direct code errors or unsafe third-party dependencies, making deterministic verification gates essential for secure development.
Key Takeaways:
• AI agents frequently introduce security flaws by writing vulnerable code (e.g., SQL injection) or installing third-party libraries with known Common Vulnerabilities and Exposures (CVEs) 2:40-3:00.
• Relying solely on a secondary AI agent for security review is insufficient because it is probabilistic; if the first agent misses an issue, the reviewer likely will too 8:48-9:05.
• Effective security requires "deterministic gates" using tools like SonarQube to guarantee consistent vulnerability detection against massive CVE databases, rather than relying on agent intuition 6:00-6:10.
• The recommended workflow integrates these deterministic scans into the coding process, forcing the AI agent to iterate and fix issues until the security scan is green before merging 9:20-9:45.
• Tools like Arkon allow developers to orchestrate these workflows, ensuring that code is classified, implemented, and verified through a repeatable, automated pipeline 1:50-2:00.
Closing Statement:
By embedding deterministic security checks directly into the AI coding workflow, developers can significantly reduce the risk of vulnerabilities slipping into production code. This approach transforms security from a hopeful afterthought into a guaranteed step in the development process.
Sources:
- 0:35 Introduction to deterministic gates and the security challenges of AI coding.
- 2:40 Explanation of how agents introduce vulnerabilities via code or dependencies.
- 4:30 Discussion on the limitations of AI in tracking the massive list of CVEs.
- 6:00 The need for deterministic verification steps in AI workflows.
- 9:20 Detailing the "deterministic gate" workflow using SonarQube.
- 12:27 Demonstration of SonarQube results and the iteration process.
- 14:13 Overview of using Arkon to orchestrate the end-to-end secure workflow.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
In almost every way, AI coding assistants can be better and faster than human engineers, assuming you have the right system and you're communicating intent properly. So, obviously, those are big ifs, but the point of this video here is even if you have the perfect system, AI coding assistants still quite often fall short with security a lot more than other aspects of code like making it reusable, well-documented, and performant. And so, we need to focus on security. People do not do it enough these days. all those horror stories of AI generated code that has a lot of loopholes in it, and so I want to show you a really simple idea today, the idea of deterministic gates, how we can make our AI code more secure. And along with that, I'm going to show you my daily workflow, the tools I actuall…