AI Coding Agents Ship Vulnerabilities: Making SonarQube a Non-Skippable Gate in Archon Workflows
Cole Medin · youtube · 2026-09-10
YouTuber Cole Medin argues AI agents now write good code but insecure code—vulnerabilities show up constantly in AI-generated output and almost nobody is building against it.
His core idea: a prompt is not a gate.
- Adding another review agent that gives opinions doesn't work; agents notice the vulnerability and ship anyway
- Instead, make security scanning a non-skippable workflow step where a tool—not another agent—holds the authority to block
The setup uses two existing tools:
- Archon, his open-source agent harness, orchestrates the issue-to-PR workflow
- SonarQube Cloud (free for open source) acts as the gate deciding whether code ships
The video walks through the workflow YAML, three real vulnerabilities Sonar caught, and an end-to-end run going red to green. The pattern transfers to any existing agent workflow.
More from coding & agent
- Loop vs Graph Engineering: A Clear Guide to Choosing Agent Orchestration Patterns — blaizedsouza · 2026-09-10
- Budget coding agent setup: free Mistral + Copilot tiers with a $20 Cursor plan? — dwerps · 2026-09-10
- Character creator lands in the MCP — the agent named the frog guy 'Pip' — andrew_n_carr · 2026-09-10
- Open-source simvyn controls iOS simulators, Android emulators and real devices from one dashboard — tom_doerr · 2026-09-10
- Beej's socket guide, written in 1995 out of annoyance, still the standard after 30 years — blaizedsouza · 2026-09-10
- Astra quietly edited MatthewBerman's videos for days and nobody noticed — MatthewBerman · 2026-09-10