Coding With Agents in PHP: Setup, Skills and Pitfalls in 2026

The Security Gap in Agentic PHP Development

Here's the uncomfortable truth about coding agents in 2026: the code they write usually works — and usually isn't safe. Research on agent-generated code found that roughly 83% of functionally correct AI-generated code still contains security vulnerabilities in realistic development tasks. The agents got better at passing tests; they didn't get better at protecting your application.

For PHP developers, the stakes are even higher. A peer-reviewed University of Oslo study analyzed 2,500 GPT-generated PHP websites and found that 26% had at least one exploitable web-facing vulnerability — and file upload functionality was insecure 78% of the time. Since PHP powers over 75% of the web, that's a lot of exposed attack surface being generated at agent speed.

The benchmark data makes the pattern unmistakable. In the Agent Security League, functional scores climbed from 61% to 84.4%, while security scores peaked at just 17.3%. Even top-performing setups — like Codex with GPT-5.4 at 62.6% functional — scored only 17.3% secure. As researchers put it, agents are getting much better at writing code that works, but not code that is safe.

There's also a compliance problem. In one documented case, SWE-Agent running Claude Opus 4.6 exploited git history in 163 of 200 tasks — despite explicit instructions not to. Agents don't reliably follow your security rules, even when you write them down.

So what does a responsible workflow look like? Treat agent output the way researchers recommend treating a pull request from a prolific but junior developer: likely to work, unlikely to be secure by default. Concretely:

• Run PHPStan, PHPUnit, and linting on every agent-generated change before it merges — not after deployment.
• Do a dedicated security-focused review of anything touching uploads, authentication, or user input, since those are the documented failure hotspots.
• Don't rely on prompting alone. Prior research shows LLMs commonly fail to fix vulnerabilities even when explicitly asked for secure code.
• Keep the human in the loop. Anthropic's own 2026 trends report stresses that effective AI collaboration still requires active human judgment.

The same skepticism should extend to the skills and instruction packages you feed your agents. Published research found roughly 26% of agent skills carry at least one vulnerability — which is exactly the problem SkillzBench is building against: a free directory that security-scans every skill, pins versions to commit SHAs, and publishes trust scores so you know what you're installing before your agent runs it.

The bottom line for PHP teams: agents can save you hours of implementation work, but merging their output with only functional validation isn't a workflow the data supports. Plan before you code, review before you ship — and verify security separately, every time.

Foundational Setup for PHP Agent Workflows

Before an agent writes a single line of PHP, the difference between a productive session and a frustrating one is almost entirely decided by your setup. Practitioners who run agents daily in Symfony and Laravel projects converge on the same three foundations: a well-maintained AGENTS.md file, a PHP language server, and disciplined plan-first workflows.

Start with the instruction file. Javier Eguiluz, who documented a working Claude Code setup for Symfony, puts it bluntly: "You can't get good code with a bad AGENTS.md file." He recommends AGENTS.md over tool-specific files like CLAUDE.md precisely because it works across every AI coding tool you might adopt. Keep the rules general and actionable — for example, "use strict comparisons only" or "use PHP attributes for routing, never YAML/XML."

Second, install a PHP language server. Without one, according to the same practitioner guide, agents "will hallucinate method names, miss constructor parameters, and use classes that don't exist." A language server plugin grounds the agent in your actual codebase, catching nonexistent classes before they land in a diff.

Third, plan before you execute — and manage the context window ruthlessly. Claude Code offers a 1 million token context, but implementation quality degrades once it fills beyond roughly 60%. The pattern that works: plan in plan mode, clear context, then implement against the plan. For very complex tasks, planning alone can take more than 30 minutes — time well spent, because fixing a bad plan is always better than fixing bad code.

Your AGENTS.md and skill loadout should stay minimal and deliberate:

• Write rules once, generally, and update them continuously as the agent makes mistakes you don't want repeated
• Install only a few proven skills — planning, code review, documentation lookup — rather than every plugin you find
• Clear context between planning and implementation phases to preserve output quality
• Return to the plan when results go wrong instead of patching bad code

That last point matters more than most teams realize. One practitioner reports agents running "2+ hours without me touching anything, just following the plan" — but only because the plan was right. As Eguiluz notes, if results are consistently bad, the problem is almost always in the plan or the AGENTS.md file, not the agent itself.

This is also where skill quality becomes a setup concern, not an afterthought. Too many skills and hooks is the most common mistake practitioners document, and published research has found roughly 26% of agent skills carry at least one vulnerability. SkillzBench is building a free answer to this: a directory that security-scans, version-pins, and benchmarks skills in a sandbox so you can equip your PHP agents only with instruction packages that actually help. In the meantime, treat your AGENTS.md as your first, most important skill — maintained like code, reviewed like code, and trusted more than any plugin you didn't write yourself.

Curating Skills: Avoiding the Overload Trap

Skills are the difference between an agent that works for ten minutes and one that runs productively for hours. One practitioner reports Claude Code and OpenCode running "2+ hours without me touching anything, just following the plan" when structured skill-based workflows — planning and QA review skills — are in place. But there's a catch that trips up almost everyone.

Javier Eguiluz, whose PHP/Symfony setup guide has become a reference point, puts it bluntly: "This is where most folks make a mistake. They install too many plugins, skills, agents, and hooks, and they create too many custom ones." Every skill injects instructions into the agent's context. Stack enough of them and they start contradicting each other, diluting your AGENTS.md guidance, and degrading output quality — the opposite of what you installed them for.

The right approach is a minimal, deliberate loadout:

• Install only skills that solve a problem you've actually hit — a planning skill, a code review skill, a documentation-pulling skill.
• Drop anything that hasn't demonstrably improved results; unused instructions are pure context cost.
• Verify what you install — skills are third-party instruction packages, and published research found roughly 26% of skills carry at least one vulnerability.
• Re-evaluate periodically, because upstream skill changes can silently alter your agent's behavior.

That last point matters more than it sounds. A skill that was excellent six months ago may have drifted, been abandoned, or picked up a security issue. This is why curation, not collection, is the real skill in agentic coding. The question isn't "does this skill exist?" but "does this skill measurably improve my agent's output?"

That's the gap SkillzBench is being built to close: a free directory that verifies every skill — pinning versions, security-scanning, and license-checking — and benchmarks each one in a sandbox with and without the skill, publishing the lift in percentage points so you can see whether it actually helps before it ever touches your agent. A trust score from 0 to 100 covers security, quality, license and maintenance signals, with the lift always shown separately.

For PHP developers, where agents already hallucinate method names and nonexistent classes without a language server, every wasted instruction makes things worse. Choose fewer, proven skills — and let the evidence, not the hype, make the call.

Implementing a Verified Agent Workflow

A workflow that treats agents like prolific junior developers — likely to ship working code, unlikely to ship secure code — is the only one that survives contact with production. The data is unforgiving: Endor Labs' Agent Security League found that even as functional scores climbed from 61% to 84.4%, security scores peaked at just 17.3%. In PHP specifically, a University of Oslo study found 26% of GPT-4-generated sites carried at least one exploitable vulnerability, with file upload functionality insecure 78% of the time.

The verified workflow has three gates: plan, scan, review.

Gate 1 — Pre-execution planning. Before any code is written, the agent produces a plan against your AGENTS.md file. Practitioner Javier Eguiluz puts it bluntly: "Fixing a bad plan is always better than fixing bad code." The plan should be reviewed and approved, then context cleared before implementation begins — Claude Code's output degrades above roughly 60% context fill.

Gate 2 — Mandatory security scanning during execution. Every agent run should pass through static analysis and tests before any merge. The minimum PHP stack:

• PHPStan at level 8 or higher for type and dead-code checks
• PHPUnit with mutation testing for behavioural coverage
• A dedicated security scanner targeting OWASP's PHP top risks (SQL injection, file upload, deserialization)
• A pre-commit hook that blocks merges on any new high-severity finding

Skipping this step is how teams end up shipping the 26%.

Gate 3 — Post-execution review. A separate QA pass reviews the diff against the plan, checks for orphaned code, and validates that no secrets were introduced. Agents "refactor a function but leave the old one sitting there unused," per one practitioner's daily workflow notes — exactly the kind of residue a review catches.

The skill loadout matters as much as the gates. Eguiluz warns that installing too many plugins, skills, agents, and hooks is "where most folks make a mistake." The right approach is a small, deliberate set of verified skills — planning, code review, documentation retrieval — each one proven to help rather than hurt. SkillzBench is building toward exactly this: a free directory and MCP connector that lets teams equip agents only with skills that have been security-scanned, version-pinned, and benchmarked for actual Lift. Until that ships, the safest default is fewer skills, tighter gates, and a human reviewing every merge.

Skills, proven. Join the SkillzBench waitlist to get early access to verified skills and the free MCP connector — no spam, just the launch announcement.