AI coding agents frequently produce insecure code because they are trained on unlabeled internet code where secure and insecure examples are mixed, and reinforcement learning has focused on functional rather than secure output. The DORA report finding that AI acts as an amplifier means bad security practices get worse with AI assistance. Rather than scanning for vulnerabilities after the fact, the talk advocates teaching agents defensive coding upfront using skills based on the OWASP Application Security Verification Standard (ASVS). A practical approach involves giving agents a security guidance skill that retrieves relevant ASVS verifications during the planning phase, combined with Claude hooks that inject security reminders during file edits. This steers agents away from probabilistic algorithm choices (e.g., picking SHA over bcrypt for password hashing) and toward established best practices. Anthropic's own security skill is also discussed, which uses regex-based pattern detection post-edit. The key takeaway is that proactively embedding security guidance into the agent's planning loop produces consistently better results than reactive scanning.