81% of Top AI Repos Have No Security CI — We Checked 500

Published March 14, 2026

We analyzed the CI/CD pipelines of the 500 most popular AI agent repositories. 404 of them — 81% — have no automated security scanning.

What We Found

We scanned every GitHub Actions workflow for security-related steps: CodeQL, Snyk, Trivy, Dependabot, SonarQube, and others. 404 of 500 repositories had none.

By Star Range

Star Range	Missing Security CI	Total	%
>100K stars	11	16	69%
>50K stars	41	58	71%
>10K stars	352	426	83%

Notable Repos With No Security CI

These projects each have over 10,000 stars and zero detected security scanning in CI:

openclaw/openclaw (218.2k stars)
tensorflow/tensorflow (193.9k stars)
Significant-Gravitas/AutoGPT (181.9k stars)
ollama/ollama (163.0k stars)
AUTOMATIC1111/stable-diffusion-webui (160.7k stars)
huggingface/transformers (156.8k stars)
f/prompts.chat (145.8k stars)
open-webui/open-webui (124.5k stars)
x1xhlol/system-prompts-and-models-of-ai-tools (115.3k stars)
microsoft/generative-ai-for-beginners (106.7k stars)
Comfy-Org/ComfyUI (103.7k stars)
supabase/supabase (97.9k stars)
pytorch/pytorch (97.6k stars)
microsoft/markitdown (87.3k stars)
opencv/opencv (86.2k stars)

The Vulnerability Scanner Results

Of the 100 most popular, 9 have high risk scores. Here are the most exposed:

#	Project	Stars	Trust	Grade	Vuln Score
1	AUTOMATIC1111/stable-diffusion-webui	160.7k	69.7	C	55
2	f/prompts.chat	145.8k	69.7	C	55
3	rasbt/LLMs-from-scratch	85.6k	69.7	C	55
4	hacksider/Deep-Live-Cam	79.6k	69.7	C	55
5	Developer-Y/cs-video-courses	74.3k	69.7	C	55
6	dair-ai/Prompt-Engineering-Guide	70.6k	69.7	C	55
7	ageitgey/face_recognition	56.1k	64.7	C	55
8	deepfakes/faceswap	55.0k	69.7	C	55
9	coqui-ai/TTS	44.6k	69.7	C	55
10	n8n-io/n8n	177.3k	51.7	C-	45

Why This Matters

These are tools developers install via pip and npm every day. Without security CI, vulnerabilities ship to production undetected. A single compromised dependency in an AI agent framework can cascade through thousands of downstream applications — from chatbots handling sensitive data to autonomous trading agents managing real funds.

The gap between popularity and security hygiene is especially alarming for projects with 50K+ stars: these are effectively critical infrastructure for the AI ecosystem, yet most lack even basic automated scanning.

Add Security Scanning in 2 Minutes

Drop this into .github/workflows/security.yml:

name: Security Scan
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Nerq Security Scan
        run: |
          pip install agent-security
          agent-security scan requirements.txt

Check Your Stack Now

Scan your own project locally:

pip install agent-security
agent-security scan requirements.txt

Or use the API: nerq.ai/v1/preflight

Full vulnerability dashboard: nerq.ai/vulnerable