More than half of developers have found security vulnerabilities in AI-assisted code after it had already been deployed. The reason is that functional code and secure code are not the same thing, and AI coding assistants don’t always know the difference.
SecureFlag’s new learning path for Secure Coding With AI is designed to change that, with hands-on labs covering everything from code review to defending against indirect prompt injection and supply chain attacks on AI agents.
The Challenges of AI Coding Assistants
The conversation around AI coding assistants tends to focus on productivity, but what’s less often discussed is what happens to security in the process.
There are a few patterns that show up repeatedly in agentic coding:
-
AI generates insecure patterns that look correct: AI output can look clean and pass tests, but the business logic behind it can still contain vulnerabilities that a security reviewer would normally catch.
-
Code is released without proper review: When AI produces code quickly, there’s an assumption that it is already safe to use. However, AI-generated code still needs the same level of review and security validation as human-written code.
-
Underutilized AI agents: Teams that use AI coding agents often don’t fully integrate them into their security environment. Limited understanding of how to connect them to tools such as SAST, DAST, and internal sources leaves much of their capability unused.
-
AI coding agents can act autonomously: Agents can update files, call APIs, or initiate workflows, and each of those actions is a potential risk when developers are not fully aware of them.
-
The tools themselves are becoming attack targets: Threats such as prompt injection, supply chain attacks via Model Context Protocol (MCP) servers, and attacks against AI coding agents are emerging risks.
What’s Inside the Course
For developers using AI coding assistants, the course covers secure development with AI, security workflow automation, and defending against AI-specific threats.
Code Review and Secure Coding with AI
Developers work through labs on conducting proper code reviews with AI, investigating and fixing logic bugs, and writing code with security in mind from the beginning.
Learners are encouraged to refine AI output and not just accept it. AI can raise issues and suggest fixes, but knowing when to challenge its output and how to apply secure coding guidelines in context is still a developer skill.
Automating Security Workflows
One of the labs in the path focuses on building a custom AI-assistant skill that automatically remediates SAST findings. For teams dealing with manual triage and growing remediation backlogs, it’s a valuable capability to learn so that AI can securely handle repetitive fixes, freeing up developer time.
In another lab, developers learn to apply secure coding guidelines through AI, ensuring automated fixes stay aligned with defined standards.
Defending Against AI-Specific Threats
As AI coding assistants have become more capable and more embedded in development processes, they’ve also become a more attractive target for attackers.
The path covers:
-
Prompt injection via indirect channels: How attackers can manipulate AI assistant behavior through content in the environment, not only direct inputs, and how to defend against it.
-
Supply chain attacks through MCP servers: MCP servers extend what AI coding agents can do, but they also introduce new supply chain risks. This lab covers how those attacks work and how internal MCP servers can be used to mitigate them.
-
Threats against AI coding agents: Agents that operate with a degree of autonomy expand the attack surface. This lab looks at how they can be targeted and what that means for how they’re deployed.
-
Hardening vibecoded functionality: AI can quickly generate working code, but that doesn’t mean it’s secure. This lab looks at realistic AI-generated functionality and explores what it takes to properly review and harden it before production.
After Completing the Path
Developers who successfully work through the path will be able to:
-
Use AI coding assistants as security tools, not just productivity shortcuts.
-
Review AI-generated code with a security mindset, including knowing where to look and what patterns to question.
-
Automate parts of the security remediation workflow using AI-assistant skills.
-
Recognize and defend against prompt injection, supply chain attacks, and threats targeting AI coding agents.
-
Apply secure coding guidelines consistently through AI, rather than relying on one-off fixes.
How SecureFlag Supports Developer Security Training
SecureFlag’s learning paths are designed for people who learn by doing. Modules combine focused explanations with hands-on labs built around realistic scenarios. The skills developed in training transfer directly to day-to-day work in the environment they already use.
As AI becomes a bigger part of how code gets written, SecureFlag is making sure security training keeps up.
