To secure AI-generated code, treat every suggestion like a pull request from a fast but inexperienced developer. Run static analysis, secret scanning and dependency checks automatically, then review authentication, authorisation and input handling by hand. AI coding assistants produce code that runs far more reliably than code that refuses to do the wrong thing, so the checks matter more, not less.
- Independent testing found AI models introduced a security flaw in 45% of coding tasks, and newer, larger models did not do better.
- The flaws cluster in input handling, authorisation, secrets and unsafe defaults: places where code works but should not.
- Static analysis (SAST) catches pattern flaws such as injection and hard coded secrets. It cannot see a missing permission check, so humans still review.
- Automate the first pass on every pull request, block merges on critical and high findings, and focus human review on access control and business logic.
- Better prompts help, but they do not replace scanning and review.
What the research says about AI-generated code security
The best controlled evidence comes from Veracode's 2025 GenAI Code Security Report. Its researchers gave more than 100 large language models 80 code completion tasks, each with a known weakness class, and checked the results with static analysis. In 45% of cases the model chose the insecure way to write the code. Java failed more than 70% of the time, and models failed to defend against cross site scripting (CWE-80) and log injection (CWE-117) in 86% and 88% of cases. Larger models were not meaningfully safer than smaller ones.
The problem is now visible in real software too. Researchers at Georgia Tech's School of Cybersecurity and Privacy built the Vibe Security Radar, which traces published vulnerabilities back to the commits that introduced them. After scanning more than 43,000 security advisories, they confirmed 74 vulnerabilities introduced by AI coding tools, 14 of them critical. Thirty five were found in March 2026 alone, compared with about 18 in the whole second half of 2025. The radar only catches commits that still carry an AI tool's signature, so the researchers describe it as the surface of the problem.
The pattern behind both studies is the same. Models are trained to produce code that looks right and runs. Security is mostly about what code must refuse to do, and that is exactly what a plausible looking suggestion leaves out.
The flaws AI assistants introduce most often
- Injection. User input flows straight into a SQL query, a shell command, a file path or HTML. The code works in the demo and is exploitable in production.
- Missing authorisation. An endpoint returns any record by its ID without checking that it belongs to the caller. Nothing about the code looks wrong.
- Hard coded secrets. Example API keys, passwords and tokens get pasted into the repository and committed.
- Unsafe defaults. Permissive CORS, disabled certificate checks, debug mode left on, missing security headers and no rate limiting.
- Risky dependencies. Outdated packages, and package names a model invented. Attackers can register those names and wait for someone to install them.
- Leaky errors and logs. Stack traces returned to users, or unsanitised input written to logs, which is where log injection comes from.
Why normal code review struggles with AI-generated code
Review was designed for code a colleague wrote slowly and understood. AI changes three things. Volume goes up, so reviewers skim. The code is idiomatic and confident, so it reads as correct. And the most dangerous flaw is often an absence, such as a permission check that was never written, which a reviewer scanning the diff will not notice.
Automated tools have the opposite blind spot. As we explain in static code analysis vs code review, static analysis is tireless at known patterns but cannot know your business rules. The answer is to use each for what it is good at.
A review checklist for AI-generated code
- Trace every input. Follow user and external input to where it is used. Queries must be parameterised, shell calls avoided or escaped, and paths and HTML encoded.
- Check who can do what. For every endpoint and action, confirm authentication and that the caller owns or may access the resource.
- Search for secrets. No keys, tokens or passwords in code, tests, fixtures or comments. Load them from the environment or a vault.
- Verify every new dependency. Confirm the package exists, is maintained and is the one you meant. Pin versions in a lockfile.
- Read the defaults. CORS, TLS verification, cookies, headers, debug flags, timeouts and rate limits.
- Look at failure paths. What happens on bad input, timeouts and errors? Nothing sensitive should reach users or logs.
- Test behaviour, not syntax. Add tests for the abuse cases, such as another user's ID, an oversized payload or a missing token, not only the happy path.
- Ask why it is there. Delete code nobody can explain. Unused endpoints and helpers are attack surface.
Automate the first pass on every pull request
People should spend review time on intent and access control, not on hunting for patterns a machine finds in seconds. A sensible pipeline for teams using AI coding tools:
| Check | Automated tool | Human reviewer |
|---|---|---|
| Injection, unsafe functions | SAST on every pull request | Confirms real findings, dismisses noise with a reason |
| Secrets | Secret scanning, pre-commit and in CI | Rotates anything that leaked |
| Dependencies | Dependency and licence scanning | Approves new packages |
| Authorisation and business rules | Limited | Primary responsibility |
| Design and maintainability | Quality metrics such as complexity and duplication | Judges whether the change is the right one |
Block merges on critical and high severity findings only, so the gate stays trusted, and run a full scan on a schedule because new rules apply to old code. Mapping findings to OWASP Top 10 and CWE Top 25 gives security and compliance owners evidence they can use.
This is the job we built Caudilysis for. One scan of your codebase reports security, engineering quality and compliance coverage across OWASP Top 10, CWE Top 25, OWASP ASVS and ISO/IEC 27001:2022, and its AI advisor explains in plain English which handful of findings to fix first. Git review on pull requests and a VS Code extension are next on the Caudilysis roadmap.
Prompting for safer code helps, but it is not a control
The Georgia Tech researchers recommend giving AI tools more detailed instructions and running vulnerability checks on what they produce. Both are worth doing. Put your security requirements in the assistant's project instructions: parameterised queries only, an authorisation check on every endpoint, secrets from the environment, no new dependencies without a note. You will get better first drafts. You will not get guarantees, because the model can still ignore or misapply an instruction, so the scan and the review stay.
Who should own AI code security
Make it a team policy rather than a personal habit. AI-assisted code goes through the same pipeline and the same review as any other code, with no fast lane. Name a security owner for the pipeline rules, review the false positive list monthly, and track how many critical findings reach the main branch. If that number is not falling, the process is not working, whatever tool you use.
Frequently asked questions
Is AI-generated code less secure than human-written code?
Controlled studies show a high flaw rate in AI output: Veracode found an insecure choice in 45% of tasks. Direct comparisons with human code depend heavily on method, so the practical answer is to treat AI-generated code as untrusted until it has passed the same scanning and review as any other change.
Can static analysis catch vulnerabilities in AI-generated code?
It catches the pattern-based ones well: injection, unsafe functions, hard coded secrets and risky dependencies. It cannot reliably catch a missing authorisation check or broken business logic, because those depend on intent the code does not state. That is why SAST and human review work together.
What is vibe coding, and is it safe?
Vibe coding means building software by prompting an AI and accepting its output with little reading or review. It is fine for prototypes and throwaway tools. For anything that handles real users, data or money, the code needs the same scanning, review and tests as code a person wrote.
If your team ships AI-assisted code and wants the guardrails set up properly, our custom software development team can build the pipeline with you, or you can run Caudilysis on your own repositories. For the delivery habits that keep this fast, see how to ship software fast without breaking things.
