Security

Hardening a Docker image means cutting the attack surface at every layer. Start from a minimal base like distroless or Alpine. Run as a non-root user. Set the filesystem read-only. Drop all Linux capabilities and add back only what the app needs. Pin dependency versions with checksums. Scan images with Trivy or Grype before you push. Each layer of this checklist stands on its own, so you can adopt them one at a time.

The numbers are in, and they’re bad. Escape.tech scanned 5,600 vibe-coded apps in the wild. It found over 2,000 bugs, more than 400 exposed secrets, and 175 leaks of personal data, including medical records and IBANs. A separate December 2025 audit by Tenzai found 69 flaws across just 15 test apps built with five popular AI coding tools. Georgia Tech’s Vibe Security Radar tracked CVEs caused by AI-generated code. They climbed from 6 in January 2026 to 35+ by March. The incidents aren’t hypothetical now. They’re outages, leaked databases, and wiped customer records.

Your AI coding agent has the same file access, shell rights, and database keys you do. A review of 78 studies from January 2026 (arXiv:2601.17548 ) tested every big coding agent. The list ran every major agentic coding assistant . All fell to prompt injection. Adaptive attacks landed more than 85% of the time. This isn’t theory. CVE-2026-23744 gave attackers remote code execution on MCPJam Inspector at CVSS 9.8. A booby-trapped PDF tripped a physical pump through a Claude MCP link at a plant. Attackers hit GitHub’s MCP server to exfiltrate private repository data via malicious issues . And 47 firms fell to a poisoned plugin ecosystem that hid for six months.

Claude Code doesn’t use MCP as a plugin system. It is MCP. On March 31, 2026, Anthropic shipped a 59.8 MB source map by accident in npm package @anthropic-ai/claude-code v2.1.88. Developers got a rare look at how a real AI coding agent works. Every capability in Claude Code (file reads, bash, web fetches, Computer Use, IDE bridges) runs as a single permission-gated MCP tool call. There is no special internal API. Third-party MCP servers you connect get the same execution path, permission checks, and error handling as Anthropic’s own built-in tools.

One missing line in a build config caused the worst source leak in AI tooling history. On March 31, 2026, Anthropic shipped version 2.1.88 of its @anthropic-ai/claude-code package with a 59.8 MB JavaScript source map inside. That map held the full client agent harness for Claude Code : 512,000 lines of readable TypeScript in 1,906 files. Mirrors of the code spread thousands of times in hours. A clean-room Python/Rust rewrite then became the fastest-growing repo in GitHub history. Anthropic’s legal response hit the wrong targets. The day got worse: a supply-chain attack hit the axios npm package, piling on for devs who rely on these tools.

You can build a self-contained pen testing lab on a Raspberry Pi 5 running Kali Linux ARM64. Add a battery HAT, a 7-inch display, and a wireless adapter that does packet injection. Total cost lands between $200 and $250. The result is a pocket-sized hacking kit that runs Nmap, Burp Suite, Wireshark, Aircrack-ng, and Metasploit in the field, at CTF events, or on jobs where you can’t lug a laptop.