Your AI Assistant Won't Tell You Your Dependencies Are Full of Known CVEs

I love how fast AI coding assistants can spin up a feature. I really do. But there is a nasty habit forming in the developer community: treating the AI's output as a finished product. You paste a snippet, it installs a package, you move on. No one checks the version. No one runs a vulnerability scan. And that is how you end up shipping a known CVE to production.

Here is the uncomfortable truth. Your AI assistant does not care about dependency hygiene. It was trained on public code, which means it will happily suggest [email protected] or [email protected] because those versions appeared in millions of GitHub repositories. Those versions also have publicly documented CVEs. The AI has no incentive to warn you. It just wants to complete the pattern.

Consider a typical interaction. You ask for a quick way to parse a YAML file in Node.js. The assistant suggests js-yaml and gives you an import statement. You run npm install js-yaml, and npm grabs the latest version by default, which is fine. But then you copy a package.json from a tutorial the AI generated earlier. That file pins js-yaml to 3.13.0. That version has CVE-2019-1010266, a denial-of-service flaw. You just installed a known vulnerability because you trusted a generated file.

This is not a theoretical risk. I have seen it in real repositories. Teams using Copilot, Cursor, or ChatGPT to scaffold projects end up with dependency trees full of old, vulnerable packages. The AI never says, "Hey, this version has a CVE." It just writes code.

Why does this happen? Because AI models are pattern matchers, not security auditors. They optimize for plausibility, not for safety. A version number that appears frequently in training data looks correct to the model. The fact that it is three years old and has a public exploit does not register. The model has no concept of a vulnerability database. It has no concept of time. It only knows what looks like code.

So what do you do? You treat every AI-generated dependency suggestion as a starting point, not a final answer. That means you run a software composition analysis (SCA) tool. You check the version against the National Vulnerability Database. You update to a patched release. And you do this before you commit, not after you deploy.

Here is a simple pattern I use. After any AI-assisted coding session, I run a quick audit. For Node.js projects, that means npm audit or yarn audit. For Python, pip-audit. For any language, there are tools like OWASP Dependency-Check or Snyk. The point is not to be perfect. The point is to catch the obvious stuff.

# After generating code with an AI assistant, run this
npm install
npm audit --production
# If vulnerabilities are found, fix them
npm audit fix
# For a more thorough check, use a dedicated SCA tool
npx snyk test

That code block is not a runnable exploit. It is a habit. A five-second habit that can save you from a breach.

But here is the part that frustrates me. Even developers who know better skip this step when using AI. Why? Because the AI makes everything feel easy. It writes the code, it suggests the package, it even writes the test. The illusion of completeness is powerful. You forget that the AI never checked for CVEs. You forget that it cannot check for CVEs. You forget that security is your job, not the model's.

I am not saying AI assistants are bad. I use them daily. They are great at boilerplate, at refactoring, at explaining unfamiliar APIs. But they are terrible at dependency hygiene. They have no memory of the last time a package was updated. They have no access to a live vulnerability feed. They will happily suggest a version that was patched two years ago.

The fix is not to stop using AI. The fix is to add a security gate to your workflow. Make it automatic. Add an SCA check to your CI pipeline. Add a pre-commit hook that runs npm audit. Add a rule in your team's style guide: no AI-generated dependency without a version check. It sounds boring. It is boring. But boring security is what keeps you out of the news.

One more thing. Do not trust the AI to tell you when a dependency is outdated. I have asked assistants to "use the latest version of X" and received a version that was two major releases behind. The model does not know what "latest" means. It only knows what was common in its training data. Always verify against the package registry.

So here is my reaction, plain and simple. AI coding assistants are a productivity multiplier, but they are also a vulnerability multiplier if you skip the basics. Dependency hygiene is not optional. It is not something you do later. It is the first thing you check after the AI writes its last line. If you do not, you are not shipping software. You are shipping known CVEs with a nice UI.

Seaworthy offers a dependency scanning service that checks your project against known vulnerability databases. That is a factual mention, not a sales pitch. Use it or use something else. Just use something.