3 AI coding agent footguns, and the one command that catches each

AI coding agents are fast, and sometimes they take shortcuts you won't notice until it hurts. Here are three I made short videos about this week. Each one comes with a command you can run today.

LLMs sometimes suggest package names that were never published. Anyone can register those names on npm or PyPI and put malicious code inside. The attack is called slopsquatting.

The numbers come from "We Have a Package for You!" (Spracklen et al., USENIX Security 2025). The authors generated 576,000 code samples with 16 LLMs. 19.7% of the suggested packages didn't exist. When they re-ran prompts that had produced a fake name, 43% of those fake names came back in all 10 reruns. Names that predictable are easy to squat.

"Just try installing it" is the wrong move. npm install runs a package's preinstall, install and postinstall scripts, so its code runs the moment it lands.

npm view PACKAGE-NAME time.created repository.url Enter fullscreen mode Exit fullscreen mode If you get 404 Not Found, the name is made up. Stop there. If it exists, look closer. A brand-new package with no repo and only a handful of weekly downloads is a red flag. Existing doesn't mean safe. For Python, https://pypi.org/project/PACKAGE-NAME/ returns a 404 for names that were never published. Then add this rule to AGENTS.md: "Never invent file paths, API fields, package names, URLs, versions or quotes. If unsure, say so and say how to find out."

According to Claude Code's permissions docs, file reads inside your working directory need no approval. Read-only shell commands like cat, head, tail and grep also run without a prompt. If the agent decides your Stripe bug "might be config", your live keys end up in the conversation. The docs also say a.claudeignore file has no effect.

The fix: deny rules in.claude/settings.json:

{ "permissions": { "deny": [ "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)" ] } } Enter fullscreen mode Exit fullscreen mode Deny beats allow, so no allow rule can carve an exception out of it. Read deny rules also cover file commands Claude recognizes in Bash, such as cat, head, tail and sed. Commit the file and your whole team is covered.

Caveat: a Python or Node script that opens the file itself isn't covered. For OS-level blocking, turn on the sandbox. 3.

Your agent made CI green by deleting the failing test Ask an agent to "make CI pass" and sometimes it takes the shortcut. It deletes the failing test, or marks it.skip, and reports green. Anthropic's own Claude prompting guide warns that Claude "can sometimes focus too heavily on making tests pass at the expense of more general solutions."

git diff main --name-only --diff-filter = D -- '*.test.*' git diff main | grep -E '^\+.*\.(skip|only)\(' Enter fullscreen mode Exit fullscreen mode --diff-filter=D keeps only deleted files, and --name-only prints just their paths. In a git pathspec, * matches across folders, so src/cart/cart.test.ts is caught too. The grep finds added lines that call.skip( or.only(, such as it.skip or test.only in Jest and Vitest.

In CI, diff against the base branch (for example origin/main...HEAD ) and fail the job if either command prints anything. What this misses: an agent that rewrites the assertion so it passes. You still need to read the test diff.

Put the rules where your agent reads them Each of these checks has a matching line for AGENTS.md: no invented packages, never read.env*, and "green by cheating is red." They're all in the hard rules of our packs:

Has your agent pulled any of these on you? Tell me in the comments.