AI Coding Assistants: How to Stay Productive Without Getting Hacked

AI coding assistants like Cursor, Claude Code, and GitHub Copilot have become standard tools for many developers. They promise significant productivity gains—faster code completion, automated refactoring, and natural-language debugging. But recent security incidents suggest that the speed these tools provide may come with serious risks. Over the past several months, researchers have documented attacks that exploit the trust developers place in these assistants, including poisoned repositories that auto-execute malicious code and coordinated campaigns that inject malware through pull requests. The question is not whether these tools are useful—they are—but how to use them without opening your project to compromise.

What Happened

In July 2026, Dark Reading reported that attackers had poisoned public repositories in a way that caused the Cursor IDE to auto-execute malicious code. Cursor, like other AI coding tools, often suggests code that it finds in public sources. When a poisoned snippet is accepted, the IDE can run it without additional approval, depending on the user’s configuration. The attack did not require the developer to manually compile or run anything—the suggestion itself set off the execution chain.

Earlier that year, in June, a campaign named Cordyceps was identified. The attackers submitted malicious pull requests to open-source projects. Because many developers now rely on AI to review or auto-merge pull requests, the malicious changes were less likely to be scrutinized. The goal was to compromise downstream users who would pull the infected code into their own projects.

In May, researchers uncovered a risk built into the trust conventions of Claude Code. Termed “TrustFall,” the issue allowed AI-generated code to execute actions on the developer’s machine without explicit confirmation, as long as the developer had accepted the tool’s default trust settings. The risk was not a software vulnerability in the traditional sense—it was a design assumption about how much control the developer should retain.

Why It Matters

These incidents highlight a fundamental tension: AI coding assistants are most productive when they have broad access to execute commands and install dependencies, but that very access creates new attack surfaces. A poisoned training dataset, a compromised package repository, or a social engineering campaign can all bypass traditional security controls because the machine itself is being asked to run code it did not explicitly author.

The scale is important. AI coding tools are used by millions of developers, many of whom work in organizations that have not updated their policies to account for the risks. Supply chain attacks have been a concern for years—malicious PyPI packages, npm typosquatting, and so on—but AI assistants accelerate the insertion of bad code because they amplify the velocity at which suggestions are accepted. A human might review a few dozen third-party packages per week; an AI assistant can suggest a few hundred snippets per day.

That said, not every risk is equally severe. The Cordyceps campaign, for example, required attackers to submit pull requests that passed initial review. The Cursor auto-execution incident required the developer to accept a suggestion from a poisoned repository—not from any source, but from a repository that the tool had been told to trust. The TrustFall issue could be mitigated by changing defaults. The threat level is real, but it is also manageable with awareness.

What Readers Can Do

You do not need to abandon AI coding tools to stay safe. What you need is a set of practical guardrails.

  • Disable automatic execution of AI suggestions. Most tools offer a way to require manual approval before any generated code is executed. Turn that on. It adds a second or two per suggestion but prevents the most dangerous class of attacks—those that execute without your consent.

  • Review third-party code before running it. This sounds obvious, but it bears repeating: code from AI assistants is not inherently safe. If the assistant suggests a dependency or a snippet from a package you do not recognize, check the package’s history, maintainers, and download statistics. Use tools like npm audit or GitHub’s Dependabot.

  • Restrict file system and network access for the AI tool. Many coding assistants run with the same privileges as the IDE. Containerize your development environment or use a sandbox that limits what the assistant can change. This is especially important if you work on sensitive projects.

  • Be cautious with pull requests from unknown contributors. The Cordyceps campaign relied on automated PR merging. If your project uses CI/CD that auto-accepts PRs from any source, review that policy. For open-source projects, require a human review for any PR that touches critical files (like package.json, requirements.txt, or build scripts).

  • Keep the tool and its dependencies updated. Just as you patch your OS and libraries, patch your AI coding assistant. New security fixes are released for these tools, and staying current reduces the window during which known vulnerabilities can be exploited.

  • Audit what data you share with the assistant. Some AI coding tools send code snippets to cloud servers for processing. If you work on proprietary code, consider local-only alternatives or verify the provider’s data handling policy. Data leakage is a less dramatic but more common risk than malware injection.

Sources

  • “AI Coding: Do Security Risks Outweigh Productivity Gains?” – Dark Reading (July 2026)
  • “Cursor IDE Auto-Executes Malicious Code in Poisoned Repos” – Dark Reading (July 2026)
  • “How AI Coding Tools Crushed the Endpoint Security Fortress” – Dark Reading (March 2026)
  • “Cordyceps: Mushrooming Malicious Pull Requests Threaten Developer Workflows” – Dark Reading (June 2026)
  • “When AI Factories Scale, Security Has to Be Engineered In” – Dark Reading (February 2026)
  • “TrustFall Convention Exposes Claude Code Execution Risk” – Dark Reading (May 2026)