Achilles + Your Coding Agent: A Security Workflow That Actually Works
· 6 min read
AI coding agents write a lot of code now. Codex on the ChatGPT desktop app, Claude Code in your terminal, OpenCode wherever you like it. They are fast, they are cheap to run, and they will happily introduce a hardcoded API key, a vulnerable dependency, or a pull_request_target workflow without breaking stride. The question is not whether your agent will write insecure code. It is what catches it before merge.
This post walks through the workflow we use: your agent writes the code, Achilles reviews it, and the two talk to each other over MCP. You can also skip the agent loop entirely, run Achilles yourself, and send a one-click prompt back into your harness when you find something. Both paths work, and both are free.