81% of Top AI Repos Have No Security CI — We Checked 500

We analyzed the CI/CD pipelines of the 500 most popular AI agent repositories. 404 of them — 81% — have no automated security scanning. What We Found We scanned the top 500 AI agent and tool repositories on GitHub by star count, checking for security-related CI/CD configurations: CodeQL, Snyk, Dependabot, Safety, Bandit, Trivy, and similar tools. The results are alarming: Star Range Repos No Security CI % >100K stars ~15 ~13 87% >50K stars ~30 ~25 83% >10K stars ~100 ~80 80% >1K stars ~350 ~280 80% The most exposed projects include AUTOMATIC1111/stable-diffusion-webui (160K+ stars), prompts.chat (145K+ stars), and Deep-Live-Cam (79K+ stars) — tools with massive download counts and zero automated security scanning. The Vulnerability Scanner Results Of the top 100 most popular AI tools, 9 scored as high-risk on our vulnerability index. Common issues: No security signals detected (no SECURITY.md, no CVE scanning) Low trust scores despite massive popularity Missing dependency auditing Why