AI coding agents produce working code that is wrong in predictable ways: committed secrets, SQL injection through abstracted query APIs, XSS, SSRF, path traversal, command injection, insecure deserialization, and weak JWT/CORS/cookie settings. The way to gate this without burying the agent in false positives is taint analysis — proving a user-controlled source actually reaches a dangerous sink — with every finding ranked by confidence.
An agent optimizes for code that runs and passes the obvious test, not for the security invariants a reviewer carries in their head. So it reaches for the convenient raw-query call, echoes user input into a response, or hardcodes a key to make the demo work. These are not random bugs; they cluster into a small, knowable set of failure classes — which is exactly what makes them gateable.
The naive fix is a pattern linter, but in an agent loop that is actively harmful: it flags safe code — parameterized queries, tagged-template SQL, schema-validated input, publishable/anon API keys, hardened cookies, allow-listed CORS, pinned JWT algorithms — and the agent either drowns or learns to ignore the tool. The signal has to be trustworthy or it is noise.
high only when a source provably flows to the sink (or a deterministic fact like a committed secret), so a CI gate or an agent can act on the high-confidence set and ignore the rest.