Summary
Cole Medin argues that AI coding assistants fail at security far more frequently than at other code quality dimensions — producing SQL injection vulnerabilities, installing packages with known CVEs, and failing to trace sub-dependency vulnerability chains — and that the industry is not taking this seriously enough. The video introduces the concept of “deterministic gates”: mandatory checkpoints in an agentic coding pipeline that use rule-based static analysis rather than a second AI agent to catch security issues before a pull request is opened.
Medin’s daily workflow runs through Arkon, his open-source agentic harness builder that lets developers package any multi-step coding process into a single orchestratable file of stitched nodes. Security gates are powered by SonarQube, which scans both written code and the full dependency tree against the CVE (Common Vulnerabilities and Exposures) database — producing deterministic pass/fail results rather than probabilistic AI judgments.
The core argument is that layering one AI agent on top of another for code review merely stacks two probabilistic systems: if the implementing agent missed a vulnerability, the reviewing agent is statistically likely to miss it too. A SonarQube gate forces the implementing agent to iterate until all flagged issues are resolved, only then allowing the pull request to open. Medin, who has partnered with Sonar, walks through a live visualization of the full workflow from issue intake through classification, planning, implementation, deterministic security scan, and PR creation.
📺 Source: Cole Medin · Published September 10, 2026
🏷️ Format: Workflow Case Study
