- by x32x01 ||
AI can help developers write code much faster, but faster code does not automatically mean safer code.
One Veracode study tested more than 150 AI models by giving them common programming tasks and then scanning the generated code with security tools. Only about 55% of the generated code was considered secure.
That means a significant portion contained known security weaknesses, including vulnerabilities related to issues covered by the OWASP Top 10.
The results become even more concerning when you look at specific vulnerability types:
The bigger problem is not just that AI can generate vulnerable code.
It's that developers may become too confident that AI-generated code is secure.
The developers using AI produced code with weaker security in the study, but there was an additional issue: they were more confident in the security of their code.
That's an important distinction.
If you know a piece of code might contain a vulnerability, you're more likely to look for it.
But if you assume the code is already secure, you may never look closely enough to find the problem. 😅
This makes AI-assisted development a security problem not only because of the vulnerabilities it can introduce, but also because of the [B>false sense of security[/B] that generated code can create.
The bigger issue is that code can now be produced faster than developers can properly review and understand it.
For years, writing code was often the bottleneck.
With AI-assisted development, that bottleneck can shift toward:
The source study cited in the original discussion found that 78% of vulnerabilities were detected by only one tool out of five.
In other words, different tools can find different problems.
A better approach is to combine multiple layers of security testing, such as:
When asking an AI assistant to generate code, explicitly mention the security requirements that matter to the application.
For example, instead of simply asking for a login system, you can ask the model to consider common security issues such as:
It simply gives the model additional security requirements to consider while generating the solution.
For example:
The important part is not to treat the second AI review as proof that the code is secure.
It is another layer of analysis.
The same model that generated the code may identify problems that were missed during generation, but it can also miss vulnerabilities again.
That's why AI review should complement, not replace, human review and security testing.
Permissions can be just as important.
The original study cited in the source reported that 60% of developers deployed code without properly adjusting permissions introduced by AI.
This is especially important when AI-generated code interacts with:
Never assume that permissions suggested by an AI model are appropriate for production.
Review them yourself and follow the principle of least privilege.
The code may:
That's because many serious vulnerabilities aren't syntax problems.
They exist in the [B>logic of the application[/B].
A scanner may detect some of them, but business-logic vulnerabilities often require someone to understand how the application is supposed to behave and then deliberately test what happens when that logic is abused.
But it has not made understanding software faster at the same rate.
That's the gap developers need to pay attention to.
AI-generated code can be useful, productive, and technically correct while still containing security vulnerabilities. The fact that the code runs successfully-or even passes automated checks—doesn't prove that it is secure.
The safest approach is to treat AI as a development assistant, not as a security authority.
Generate faster. Review carefully. Test independently. Understand what you're deploying. 🔐
The important question is simple:
When AI writes your code, do you review it line by line-or do you keep going as soon as it works?
One Veracode study tested more than 150 AI models by giving them common programming tasks and then scanning the generated code with security tools. Only about 55% of the generated code was considered secure.
That means a significant portion contained known security weaknesses, including vulnerabilities related to issues covered by the OWASP Top 10.
The results become even more concerning when you look at specific vulnerability types:
- 86% of the samples failed to properly protect against XSS.
- Java performed particularly poorly, with 72% of the generated Java code failing the security tests.
The bigger problem is not just that AI can generate vulnerable code.
It's that developers may become too confident that AI-generated code is secure.
The Real Risk: False Confidence
Another study compared developers who used AI with developers who did not.The developers using AI produced code with weaker security in the study, but there was an additional issue: they were more confident in the security of their code.
That's an important distinction.
If you know a piece of code might contain a vulnerability, you're more likely to look for it.
But if you assume the code is already secure, you may never look closely enough to find the problem. 😅
This makes AI-assisted development a security problem not only because of the vulnerabilities it can introduce, but also because of the [B>false sense of security[/B] that generated code can create.
AI Makes Writing Faster, Not Understanding
The problem isn't necessarily AI itself.The bigger issue is that code can now be produced faster than developers can properly review and understand it.
For years, writing code was often the bottleneck.
With AI-assisted development, that bottleneck can shift toward:
- Code review
- Security testing
- Understanding application logic
- Validating permissions
- Testing edge cases
- Finding vulnerabilities that automated tools miss
Don't Rely on a Single Security Scanner
Using security tools is important, but one scanner should not be treated as proof that your application is secure.The source study cited in the original discussion found that 78% of vulnerabilities were detected by only one tool out of five.
In other words, different tools can find different problems.
A better approach is to combine multiple layers of security testing, such as:
- Static analysis
- Dependency scanning
- SAST tools
- Dynamic testing
- Manual code review
- Application security testing
- Developer-led testing of business logic
Tell the AI to Think About Security
AI models don't necessarily assume every security requirement you have in mind.When asking an AI assistant to generate code, explicitly mention the security requirements that matter to the application.
For example, instead of simply asking for a login system, you can ask the model to consider common security issues such as:
- SQL injection
- XSS
- CSRF
- Authentication flaws
- Authorization problems
- Insecure direct object references
- Improper input validation
- Sensitive data exposure
It simply gives the model additional security requirements to consider while generating the solution.
Make the AI Review Its Own Code
One useful practice is to ask the AI to perform a separate security review after generating the code.For example:
Review this code for security vulnerabilities. Identify potential XSS, SQL injection, authentication, authorization, input validation, and business logic issues.The important part is not to treat the second AI review as proof that the code is secure.
It is another layer of analysis.
The same model that generated the code may identify problems that were missed during generation, but it can also miss vulnerabilities again.
That's why AI review should complement, not replace, human review and security testing.
Permissions Still Need Human Review
Security problems aren't limited to vulnerable functions or unsafe input handling.Permissions can be just as important.
The original study cited in the source reported that 60% of developers deployed code without properly adjusting permissions introduced by AI.
This is especially important when AI-generated code interacts with:
- Databases
- Cloud resources
- Files
- APIs
- Authentication systems
- User accounts
- Production infrastructure
Never assume that permissions suggested by an AI model are appropriate for production.
Review them yourself and follow the principle of least privilege.
Clean Code Doesn't Mean Secure Code
One of the easiest traps with AI-generated code is that it often looks clean.The code may:
- Pass linting
- Follow common coding conventions
- Have clear variable names
- Use familiar frameworks
- Look professionally structured
That's because many serious vulnerabilities aren't syntax problems.
They exist in the [B>logic of the application[/B].
A scanner may detect some of them, but business-logic vulnerabilities often require someone to understand how the application is supposed to behave and then deliberately test what happens when that logic is abused.
A Practical Workflow for AI-Assisted Development
If you're using AI to write production code, a safer workflow is:- Define security requirements in the prompt.
Tell the AI what security concerns it must consider. - Review the generated code.
Don't assume that working code is secure code. - Ask the AI for a separate security review.
Use it as another layer of analysis, not as final approval. - Run more than one security tool when practical.
Different tools can identify different vulnerabilities. - Review permissions manually.
Pay special attention to database, API, cloud, and production access. - Test application logic.
Don't limit testing to syntax, linting, and automated scanning. - Understand the code before deploying it.
If you can't explain what the code does and what access it requires, it deserves another review.
The Bottom Line
AI has made software development faster.But it has not made understanding software faster at the same rate.
That's the gap developers need to pay attention to.
AI-generated code can be useful, productive, and technically correct while still containing security vulnerabilities. The fact that the code runs successfully-or even passes automated checks—doesn't prove that it is secure.
The safest approach is to treat AI as a development assistant, not as a security authority.
Generate faster. Review carefully. Test independently. Understand what you're deploying. 🔐
The important question is simple:
When AI writes your code, do you review it line by line-or do you keep going as soon as it works?