--- title: "Teaching your coding agent defensive coding - Erlend Oftedal - NDC AI 2026" url: https://daily.dev/posts/teaching-your-coding-agent-defensive-coding---erlend-oftedal---ndc-ai-2026-qrzagnng3 source_url: https://www.youtube.com/watch?v=VUZpQgNaO4s type: video:youtube source: "NDC Conferences" published: 2026-07-01T14:23:34.856Z updated: 2026-07-01T16:22:35.223Z tags: ["security", "ai-agents", "claude"] reading_time: 25 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Teaching your coding agent defensive coding - Erlend Oftedal - NDC AI 2026 **[NDC Conferences](https://daily.dev/sources/ndc)** · 25 min read · 1 upvotes · 0 comments ## Summary AI coding agents frequently produce insecure code because they are trained on unlabeled internet code where secure and insecure examples are mixed, and reinforcement learning has focused on functional rather than secure output. The DORA report finding that AI acts as an amplifier means bad security practices get worse with AI assistance. Rather than scanning for vulnerabilities after the fact, the talk advocates teaching agents defensive coding upfront using skills based on the OWASP Application Security Verification Standard (ASVS). A practical approach involves giving agents a security guidance skill that retrieves relevant ASVS verifications during the planning phase, combined with Claude hooks that inject security reminders during file edits. This steers agents away from probabilistic algorithm choices (e.g., picking SHA over bcrypt for password hashing) and toward established best practices. Anthropic's own security skill is also discussed, which uses regex-based pattern detection post-edit. The key takeaway is that proactively embedding security guidance into the agent's planning loop produces consistently better results than reactive scanning. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude) [View this post on daily.dev](https://daily.dev/posts/teaching-your-coding-agent-defensive-coding---erlend-oftedal---ndc-ai-2026-qrzagnng3)