# AI Coding Agents and Security Risks

**Podcast:** The Changelog: Software Development, Open Source
**Published:** 2026-03-10

## Transcript

What's up, friends?
Adam here.
Big week here at Changelog, some big change all around.
But the bigger news since we last shipped news was AWS data centers getting bombed by Iran to take down Claude.
Seriously, you can't make this stuff up.
And on the lighter side of things, because that's kind of heavy, we have new MacBook models with M5 Pro and M5 Max available to pre-order.
I'm so torn and so tempted.
Okay, let's get into the news.
GPT 5.4.
Opening eye shipped their latest model last Thursday.
GPT 5.4 is seriously good.
And the phrase, trust the model has never been more true for coding.
Our friends at Augment Code made this statement quote, it is the first model we've used that feels built for agent workflows, planning cleanly, delegating well, and consistently following through without getting lost halfway.
End quote.
If you're sleeping on codex or GPT 5.4, you might be missing out.
Living human brain cells played Doom on a CL1.
When I talked to Drew Wilson back in episode 639, link in the show notes, of course, about chasing that next big thing.
He mentioned his design work on Cortical Labs and the CL1.
And now the thing plays Doom, and they have the video to prove it.
The future's now, my friends, the future's now.
I was a 10X engineer, and now I'm useless.
So I'm linking up a video on X from Mobotar.
It hits on this toll booth idea as well as the idea of OMG.
Why would I keep writing code by hand when this thing can produce better and faster or near instantly?
Yeah, we're all just tiptoeing around these feelings.
But Mo put it out there and he put it out there well.
Looking to get Mo on a pod coming soon.
Check your DMs, Mo.
Check your DMs.
Your code base is full of bugs.
Okay, so I haven't tried this out yet for myself, but I saw enough posts on X about it, so I had to share it here with you guys.
Detail.dev scans your code base to find serious bugs.
Each scan spends a few hours exercising your code in creative ways to uncover bugs you'll be glad to know about.
If you haven't tried it out yet, go to detail.dev.
And now for some sponsored news.
Here's a fun experiment.
Ask your coding agent to recommend a logging library for your next project.
Now check when that recommendation was last updated.
Here's the thing AI coding agents are trained on data with a knowledge cutoff.
That package they just confidently recommended.
Could have three CVEs disclosed since the model learned about it.
Your code runs, but your security audit does not.
That's my sonotype built guide.
And here's the fun part.
The unauthenticated version is ready for you to play with.
No sign up, no credit card.
Here's your challenge.
Just go to guide.sonotype.com.
That's guide.so-n-a-ty-p-e.com.
Search for dependency, your AI recently recommended, and see what Sonotype knows that your model does not.
Results will be interesting.
Learn more at Sonotype.com or check the full link in the newsletter.
Talk to the handy.
If you're like me, you're talking to your software now.
You're not typing all the things, you're kind of talking all the things.
So you could drop the paywall from your talk tools out there and talk to the handy.
Handy is a free and open source speech to text Mac app that runs locally on your computer.
Press a keyboard shortcut, speak, and it pays the transcription into whatever text field you're typing into.
The best part, it is fully private since all transcription happens on device.
No audio gets sent to the cloud at all.
Check it out.computer.
Bring haptics to the web.
It is time to bring those haptics we all love to the web.
Now you can make your app feel as good as it looks.
Create custom tactile patterns with strengths and durations for your web interactions.
And it works with the usual suspects, React, TypeScript, View, and Svelte.
Check it out.
Haptics.lochi.me.
That's haptics.locie.me.
Link in the show notes.
Well, that wraps up news this week.
Taking a week off next week.
Spring break is here next week.
So no news next week, but normal pods are shipping as planned.
All right.
That's it for this week.
We'll see you again real soon.