Uncomfortable facts: Human code is brittle. Coding agents have made code abundant and cheap. Open models keep getting better; and incidents where agents exploit vulnerabilities in APIs and software written by humans happened and will increase in volume as tokens get smarter and more accessible.
Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident
This poses a huge security risk, in particular for companies with non-infinite budgets.
But there are things we can do to proactively tackle this problem, and try to reduce the risks of being hacked by remote agents.
This is what we will be implementing at Cubiq in the next few weeks, of course in our bootstrapped, low-budget but efficient way.
Agentic code auditing
We will assume that there are two types of it: Static auditing and Runtime auditing.
In this article we will talk about the latter.
For example at Cubiq we use Opencode as a synchronous code agent, shoutout to Kimi K3 Max and Qwen 3.8 max. But Opencode could be used for async tasks like periodic, automated, multiple-agent static code analysis and auditing.
We wrote a simple bash script with a prompt to test this out against our Cubiq API.
We asked the agent to order findings by their severity and to notify the summary to our company Telegram group.
Scary stuff that has all been fixed by now, but still… Cubiq has several APIs, from E-Commerce to Logistics. And these low hanging fruits were hanging in there, waiting for the catch. Like a "coldcard" bug 😉
Find the audit.sh here. We need to make this better pointing the agent to known security vulnerabilities databases like CVE https://www.cve.org/ and the kind.
So, rogue agentic attacks are not a thing of the future or a cool Sci-Fi Cyberpunk anime movie.
When AI agents write the code, and autonomous agents scan the web to exploit it, your defense must become one too. If you aren't using local agents to hack your own stack, rogue agents across the wire will do it for you.
IT companies, and more broadly every project exposed to the Internet will need to step up, be aware of the new risks agentic LLMs pose, a new threat model and a new speed at which things can go wrong and take countermeasures now.
This of course might become an industry in itself. One thing is for sure, we are not going back, even after the token-spending fever stabilizes.
Game is on!
I explore more in-depth ideas about agentic code auditing in this Nostr article (English only).
(Don't know what Nostr is? Check it out here).
Be safe!
