Listen to this Post
Introduction:
AI coding agents like Claude Code are designed to reuse existing code to minimize changes – a best practice for software engineering 99% of the time. However, this behavior turns legacy vulnerabilities into propagating threats: when a helper function contains a hidden flaw like prototype pollution, the agent will silently replicate that flaw into every new feature that touches the same codebase. What used to be a localised bug now becomes a systemic security debt amplifier.
Learning Objectives:
- Understand how prototype pollution works in JavaScript/Node.js and why AI agents inadvertently propagate it.
- Implement static analysis and pre-commit hooks to detect vulnerable patterns before AI-generated code lands in production.
- Harden your CI/CD pipeline and AI assistant workflows to break the chain of insecure code reuse.
You Should Know:
1. Understanding Prototype Pollution in JavaScript
Prototype pollution is a vulnerability where an attacker manipulates an object’s prototype (__proto__, constructor.prototype, etc.) to inject properties into all objects derived from that prototype. This can lead to denial of service, property injection, or even remote code execution in certain runtimes.
Vulnerable `deepMerge` function (common in many codebases):
function deepMerge(target, source) {
for (let key in source) {
if (source.hasOwnProperty(key)) {
if (isObject(target[bash]) && isObject(source[bash])) {
deepMerge(target[bash], source[bash]);
} else {
target[bash] = source[bash];
}
}
}
return target;
}
Step‑by‑step exploit (Linux/Node.js):
1. Save the vulnerable code as `merge.js`.
- Run `npm init -y && node merge.js` to execute.
3. Payload: `deepMerge({}, JSON.parse(‘{“__proto__”:{“isAdmin”:true}}’))`
- After pollution, any new object `{}` will have
isAdmin = true.
How to test for pollution:
Use this Node.js snippet:
const before = {}.isAdmin;
console.log('Before:', before);
const malicious = JSON.parse('{"<strong>proto</strong>":{"isAdmin":true}}');
deepMerge({}, malicious);
console.log('After:', {}.isAdmin); // true – polluted!
Mitigation (Linux/Windows):
Use `Object.create(null)` for safe dictionaries or validate keys explicitly:
const safeMerge = (target, source) => {
const disallowed = ['<strong>proto</strong>', 'constructor', 'prototype'];
for (let key in source) {
if (disallowed.includes(key)) continue;
// ... rest of merge logic
}
};
2. How AI Agents Amplify Vulnerabilities
When you ask Claude Code (or any agent) “Add a function that merges per-user preference updates into a userPrefs object”, the agent will scan the existing codebase for a merge helper. Finding deepMerge, it will reuse it – because that’s efficient and matches engineering best practices. The new `applyUserPrefs` function becomes vulnerable to the same prototype pollution.
Example prompt that leads to replication:
“Add a helper `applyUserPrefs(userId, updates)` that merges the updates into the user’s preference object stored in memory.”
Agent’s likely output (abbreviated):
function applyUserPrefs(userId, updates) {
let userPrefs = getUserPrefs(userId);
// Reuses existing deepMerge – vulnerable!
return deepMerge(userPrefs, updates);
}
Why this is dangerous:
The vulnerability is now present in two places. Next week, the agent will reuse `applyUserPrefs` elsewhere, and the pollution propagates further – silently, quickly, and without any human review of the original flaw.
Detection approach (pre‑commit hook with grep):
Linux command to flag dangerous key names in merge logic:
grep -rnw './src' -e '<strong>proto</strong>' -e 'constructor['
Windows PowerShell equivalent:
Get-ChildItem -Recurse -Filter .js | Select-String -Pattern "<strong>proto</strong>|constructor["
3. Mitigation: Sanitizing Keys in Merge Functions
The most effective fix is to reject any key that walks the prototype chain. Implement a safe `deepMergeSafe` and replace all calls to the vulnerable version.
Fixed deepMerge function:
const safeKeys = new Set(['<strong>proto</strong>', 'constructor', 'prototype']);
function deepMergeSafe(target, source) {
for (let key in source) {
if (safeKeys.has(key)) continue;
if (typeof key === 'string' && key.includes('__')) continue;
if (source.hasOwnProperty(key)) {
if (isObject(target[bash]) && isObject(source[bash])) {
deepMergeSafe(target[bash], source[bash]);
} else {
target[bash] = source[bash];
}
}
}
return target;
}
Step‑by‑step to refactor:
1. Create `lib/safeMerge.js` with the above code.
- Run `npm run test` to ensure no breaking changes.
- Use `grep` (as shown above) to find every `deepMerge` import.
- Replace each with `deepMergeSafe` – or alias the safe version.
- Commit and push – now the AI agent will only see the safe version.
4. Automated Detection with SAST Tools
Prevent vulnerable patterns from ever entering your repository. Use Semgrep or ESLint with security plugins.
Install Semgrep (Linux/macOS):
python3 -m pip install semgrep semgap --config "p/javascript" ./src
Windows (using WSL or Python):
python -m pip install semgrep semgrep --config "p/owasp.top10" .\src
Create a custom Semgrep rule (`prototype-pollution.yaml`):
rules:
- id: prototype-pollution-merge
patterns:
- pattern: |
function $FUNC(...) {
...
for (let $KEY in $SOURCE) {
...
$TARGET[$KEY] = ...
}
}
- pattern-not: |
... safeKeys.has($KEY) ...
message: "Potential prototype pollution – keys like <strong>proto</strong> not filtered"
severity: ERROR
Run it in CI (GitHub Actions example):
- name: Semgrep scan run: semgrep --config .semgrep/ --error --sarif --output results.sarif ./src
5. Hardening AI Agent Workflows with Hooks
Claude Code supports post‑tool hooks that fire after every file edit or write. Use this to automatically scan AI‑modified code for dangerous patterns before the change is accepted.
Post‑tool hook script (Linux `post-edit.sh`):
!/bin/bash Runs after Claude edits any .js file FILE="$1" if grep -q "__proto__|constructor[" "$FILE"; then echo "❌ SECURITY: Prototype pollution pattern detected in $FILE" echo "Rejecting change – please use deepMergeSafe instead." exit 1 fi echo "✅ No prototype pollution patterns found."
Configure hook in Claude Code (`~/.claude/config.json`):
{
"hooks": {
"post-tool": {
"Edit": ["/home/user/bin/post-edit.sh $CLAUDE_FILE"],
"Write": ["/home/user/bin/post-edit.sh $CLAUDE_FILE"]
}
}
}
Windows PowerShell equivalent (`post-edit.ps1`):
param($FilePath)
if (Select-String -Path $FilePath -Pattern "<strong>proto</strong>|constructor[" -Quiet) {
Write-Host "❌ SECURITY: Prototype pollution pattern detected in $FilePath"
exit 1
}
Write-Host "✅ Safe"
6. API Security: Preventing Pollution in User Input
Prototype pollution often enters via JSON API endpoints. Implement middleware that strips dangerous keys from all incoming requests.
Express.js middleware (Node.js):
const sanitizeKeys = (obj) => {
const forbidden = ['<strong>proto</strong>', 'constructor', 'prototype'];
if (typeof obj !== 'object' || obj === null) return obj;
for (let key of Object.keys(obj)) {
if (forbidden.includes(key)) delete obj[bash];
else sanitizeKeys(obj[bash]);
}
return obj;
};
app.use(express.json());
app.use((req, res, next) => {
req.body = sanitizeKeys(req.body);
next();
});
Testing the middleware (curl command):
curl -X POST http://localhost:3000/api/user \
-H "Content-Type: application/json" \
-d '{"<strong>proto</strong>":{"isAdmin":true},"name":"test"}'
Middleware strips <strong>proto</strong>, leaving only {name:"test"}
7. Cloud Hardening: Runtime Protection
In production, add a Node.js flag to disable prototype manipulation entirely (available in Node.js 12+ with --disable-proto=delete).
Start your Node.js app securely (Linux/Windows WSL):
node --disable-proto=delete app.js
Dockerfile addition:
CMD ["node", "--disable-proto=delete", "server.js"]
AWS WAF rule to block prototype pollution payloads:
Use a regex match statement on the request body:
`(\%22__proto__\%22|\%22constructor\%22|\%22prototype\%22)`
Azure Application Gateway rule:
Add a custom rule with pattern matching `__proto__` in JSON payloads.
What Undercode Say:
- AI agents are pattern amplifiers, not just pattern matchers. Insecure legacy code becomes the “golden pattern” that AI replicates across the entire codebase – vulnerabilities now spread faster than any human copy-paste era.
- Security must shift left into the agent workflow. Hooks, SAST, and runtime flags are necessary; relying solely on prompt engineering (“make it secure”) fails for non‑trivial vulnerabilities.
- Prototype pollution is a canary in the coal mine. The same propagation happens for SQL injection helpers, unsafe deserialization, and hardcoded secrets. Your AI toolchain is only as secure as your least secure reusable function.
This is not a flaw in any specific AI model – it is an emergent property of how agents are optimised for code reuse. The solution is to instrument the development environment so that every code generation, every merge, and every commit is scanned against vulnerability patterns. Otherwise, your security debt compounds exponentially with every feature an agent ships.
Prediction:
Within 18 months, enterprise AI coding agents will include mandatory, built‑in security scanning hooks as a standard feature – not optional. We will see the rise of “Secure‑by‑Default Agent” certifications (e.g., OWASP AI‑SAST). Organisations that fail to implement pre‑commit vulnerability propagation checks will experience high‑severity breaches originating from AI‑generated code that reused a 3‑year‑old vulnerable helper function. The platform wars will shift from “which agent writes the most code” to “which agent implicitly refuses to write insecure code.”
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Florian Ethical – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
