Skip to content
TopicTracker
From HackerNewsView original
TranslationTranslation

34,266 repos were scanned: 1 in 4 orgs showed gaps in AI agent config files

Codacy scanned 34,266 repositories and found that one in four organizations had vulnerabilities in their AI agent configuration files, exposing them to potential security risks such as data leaks and unauthorized access.

Background

Codacy is a code-review automation and static-analysis platform used by engineering teams. It scanned 34,266 public GitHub repositories belonging to organizations that use its service, looking at configuration files for popular AI coding agents (Cursor, Windsurf, Copilot, Aider, Cline). The key finding: in 26% of those organizations, at least one repo had an AI agent config file that was either not in `.gitignore` or not locked to a specific version — risks that can lead to unwanted code changes or supply-chain issues. The post serves as a data-driven reminder that adopting AI-assisted development tools without basic hygiene (ignoring config files, pinning versions) introduces real security and reproducibility problems.

Related stories