TL;DR
- AI coding agents install packages on their own, mid-session, and they get approved on reflex, not review.
- That opens two risks at once: a malicious package can compromise the developer’s machine instantly, while a merely risky one can quietly poison your SBOM.
- OX VibeSec’s new Dependency Vetting capability inspects every install attempt against policy and blocks bad ones before they land with no workflow change required.
There’s a moment that happens dozens of times a day inside engineering orgs, and almost nobody stops to notice it.
An AI coding agent decides it needs a package to handle a parsing job, and it asks the developer for permission. The developer, mid-flow, chasing the same velocity the agent promised them, clicks yes.
Was the dependency vetted? Not really, because stopping to vet it would defeat the purpose of using the agent in the first place.
Multiply that reality across every user, every session, every day, and you get a quiet, compounding fact: a meaningful share of what’s now running inside your codebase was never reviewed by anyone. Not a security team. Not even, in any real sense, the developer who approved it.
The security risks of AI agent package installs
AI coding agents don’t just suggest packages anymore. They install them, on their own, mid-session. The confirmation prompt exists, but developers often treat it the way most of us treat cookie banners: an obstacle between us and the thing we’re trying to do, not a decision.
That habit opens two separate risks at once.
A malicious package can compromise the developer’s machine the instant it lands — credentials, tokens, whatever else lives in that environment. A merely risky one (i.e. something with a critical CVE, a license that doesn’t clear legal review, or a version published hours ago by an account nobody’s heard of) can slip quietly into your SBOM, becoming someone else’s problem months from now.
Governance has to follow the agent, not the developer
Security has spent decades building controls around what developers do: code review, commit hooks, CI gates, PR approval. Those controls assume a human is making the decision at a pace a human can be held accountable for.
AI agents break that assumption. They make autonomous install decisions dozens of times a session, and none of those decisions were ever built to require the same friction a pull request does. The front door to your systems isn’t the password anymore. Increasingly, it’s whatever the agent decides to pull in.
Governance has to move to where the decision is actually happening: the install attempt itself, checked deterministically, before anything lands.
OX VibeSec adding dependency vetting
OX VibeSec already governs what each AI user can run (which agents, which MCPs, which packages, against what data) steering agents toward secure decisions before they harden into code or a live exploit.
Dependency vetting extends that governance to every install attempt. It inspects each dependency an agent tries to pull in, checks it against policy, and blocks bad attempts with a clear, actionable reason before the package ever touches the developer’s machine or your SBOM.
- Available today: Known-malicious packages are blocked outright, no exceptions. There’s also a configurable cool-down period that blocks freshly published packages before the community has had a chance to flag them.
- Coming soon: Vulnerability-based blocking against critical CVEs, and license policy enforcement, so a package that violates your organization’s license rules never makes it in.
Speed of innovation remains, with more security
Dependency vetting doesn’t ask AI users to change how they work. There’s no new approval step to sit through, no extra tool to open.
The check happens in the same moment the install would have happened anyway. It just now has an actual decision behind it, instead of a rubber stamp.
That’s the same principle behind everything VibeSec does: catch the risk before it becomes something real, without asking the org to trade velocity for it.
Want to see it in action? Sign up for a demo of OX Security today.
