Hacker Valley Studio When AI Ships the Code, Who Owns the Risk with Varun Badhwar and Henrik Plate
Jan 8, 2026
Varun Badhwar, co-founder and CEO of Endor Labs, and Henrik Plate, Principal Security Researcher at Endor Labs, dive into the complexities of AI-assisted software development. They discuss the rapid adoption of MCPs and the emerging security risks, including malicious packages that exploit agents. The conversation highlights the shortcomings of traditional AppSec and argues for embedding security in IDEs. With insights from their 2025 State of Dependency Management report, they stress the importance of integrating security from the start to combat rising vulnerabilities.
AI Snips
Chapters
Transcript
Episode notes
Functionality Often Masks Insecurity
- AI coding agents produce functionally correct code but often replicate insecure patterns learned from public code.
- Only a small fraction of agent-generated code is both functional and secure, creating hidden security debt.
MCP Adoption Exploded
- The open source community rapidly created thousands of MCP servers, demonstrating fast adoption.
- Rapid growth raises trust and vetting challenges for organizations picking MCPs from public repos.
Vet MCPs Before Use
- Do vet MCP servers before integrating them: check licenses, dependencies, and use of sensitive APIs.
- Treat MCPs like any third-party code and enforce verification and runtime guards.