81% of Top AI Repos Have No Security CI — We Checked 500

We analyzed the CI/CD pipelines of the 500 most popular AI agent repositories. 404 of them — 81% — have no automated security scanning.

What We Found

We scanned the top 500 AI agent and tool repositories on GitHub by star count, checking for security-related CI/CD configurations: CodeQL, Snyk, Dependabot, Safety, Bandit, Trivy, and similar tools.

The results are alarming:

Star Range	Repos	No Security CI	%
>100K stars	~15	~13	87%
>50K stars	~30	~25	83%
>10K stars	~100	~80	80%
>1K stars	~350	~280	80%

The most exposed projects include AUTOMATIC1111/stable-diffusion-webui (160K+ stars), prompts.chat (145K+ stars), and Deep-Live-Cam (79K+ stars) — tools with massive download counts and zero automated security scanning.

The Vulnerability Scanner Results

Of the top 100 most popular AI tools, 9 scored as high-risk on our vulnerability index. Common issues:

• No security signals detected (no SECURITY.md, no CVE scanning)
• Low trust scores despite massive popularity
• Missing dependency auditing

Why This Matters

These are tools that developers install via pip and npm every day. Without security CI, vulnerabilities can ship to production undetected. A single compromised dependency in a popular AI framework could affect thousands of production deployments.

Add Security Scanning in 2 Minutes

name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Security Scan
        run: |
          pip install agent-security
          agent-security scan requirements.txt

Check Your Stack Now

pip install agent-security
agent-security scan requirements.txt

Full report with all data: nerq.ai/vulnerable

---

Data from Nerq — the AI asset trust database indexing 204K+ agents and tools with independent trust scores.