Loading story…
Two new studies found that AI-generated application code frequently contains exploitable vulnerabilities, with risk varying sharply by model, framework, and application size. Secure Code Warrior said testing of 1,760 complete codebases produced by 16 frontier models uncovered more than 27,000 vulnerabilities, averaging 15 confirmed flaws per codebase and 4.3 critical or high-severity issues. Researchers said no single model was consistently safest across all environments; instead, each model showed a repeatable security fingerprint, with recurring OWASP weakness patterns and common omissions such as authentication checks and input validation.
Xint.io separately identified 434 exploitable flaws in AI-generated or AI-hardened applications, reporting that denial-of-service and resource exhaustion bugs, authorization failures, insecure direct object reference, and traversal or SSRF issues were common. The most severe findings were tied to hardcoded or default secrets and debug-mode remote code execution, while authorization weaknesses worsened as application size increased, particularly in a larger brownfield Gnuboard7-based app. Both reports said organizations should expect continued AI-assisted development and strengthen security review around recurring weaknesses such as hard-coded credentials, sensitive data leakage into logs, cross-site scripting, predictable session tokens or reset codes, and path traversal.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
An academic study from Beacom College of Computer & Cyber Sciences found exploitable vulnerabilities in every automation script generated by ChatGPT, Microsoft Copilot, and Google Gemini for web scraping, email automation, and file workflow tasks. Researchers identified 45 findings across nine Python scripts, collapsing them into 17 distinct vulnerability classes including SSRF, path traversal, email injection, symlink issues, and overly broad exception handling.
Xint.io analyzed AI-generated or AI-hardened applications and found 434 exploitable security flaws across the tested apps. The study highlighted denial-of-service, authorization, IDOR, traversal, SSRF, hardcoded secrets, and debug-mode remote code execution as major issues, while noting some improvement in certain injection and access-control bug classes.
Secure Code Warrior tested 1,760 complete codebases generated by 16 frontier models and found more than 27,000 vulnerabilities overall, averaging 15 confirmed vulnerabilities per codebase. The report concluded that security outcomes varied significantly by model-framework pairing and that models showed repeatable security fingerprints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple studies and industry reports found that **AI-generated or "vibe-coded" software is frequently shipped with serious security flaws**, including XSS, SQL injection, hardcoded secrets, unsafe `eval` usage, weak authentication logic, wildcard CORS, exposed `.env` data, and insecure dependencies. One analysis of 5,600 publicly accessible AI-built applications reported more than 2,000 high-risk vulnerabilities and over 400 exposed secrets, while a separate review of 549 self-described AI-generated repositories found widespread committed secrets, injection issues, hardcoded passwords, and other common sanitization failures. Veracode and other researchers similarly warned that code produced by large language models often maps to **OWASP Top 10** weakness classes and that repeated AI-assisted edits, poor prompts, and excessive agent permissions can further increase risk. At the same time, researchers and vendors highlighted both the promise and fragility of AI-assisted security tooling. Trail of Bits reported that OpenAI Codex goal-based prompting helped uncover previously unknown bugs in projects including **Rust**, **curl**, **zlib**, and **Keycloak**, but stressed that human experts were still needed to scope goals, validate findings, and handle disclosure. New academic work also showed that **LLM-based vulnerability detectors can be easily misled**: the ALIBI framework used adversarial code comments to evade four detectors with success rates above 90%. In response to growing concern over agent reliability, Amazon backed the Lean language project to strengthen formal verification for AI agents, while security experts argued that theorem proving can improve assurance for high-risk components but should be applied selectively as part of broader defense-in-depth.
Aug 4, 2026
The widespread adoption of generative AI (GenAI) tools in software development has significantly increased productivity, enabling developers to document, write, and optimize code at unprecedented speeds. According to a 2023 McKinsey study, organizations have rapidly integrated AI into their development workflows, with 83% using AI for code creation and 57% relying on AI-powered coding tools as a standard practice. However, this surge in AI-assisted coding has introduced new security risks, as traditional security models focused on perimeter or infrastructure controls do not adequately protect the data and code generated by these tools. Studies have revealed that nearly half of code snippets produced by popular AI models contain vulnerabilities, underscoring the prevalence of insecure code generation. High-profile incidents, such as Samsung's 2023 ban on ChatGPT following a sensitive code leak, highlight the real-world consequences of insufficient safeguards when using GenAI in development environments. The responsibility for securing data and code remains with developers, even as cloud providers secure the underlying infrastructure. The rapid pace of AI-generated code has outstripped the ability of traditional secure coding training to keep up, shifting the focus from training human programmers to ensuring that AI systems themselves are capable of secure coding. Industry experts note that AI is currently less effective at producing secure code than human programmers, with multiple studies and reports from sources like Schneier on Security, Veracode, and SC Media confirming this trend. The volume of vulnerabilities continues to rise, with over 47,000 publicly known vulnerabilities expected in a single year and at least 130 new vulnerabilities reported daily. This ongoing wave of vulnerabilities leads to constant exploitation and patching, further emphasizing the need for secure coding practices at the AI level. While AI has delivered substantial productivity gains—developers report 30% to 40% increases—these benefits are undermined by the security shortcomings of AI-generated code. The industry is now at a crossroads, where the imperative is to teach AI systems to code securely, rather than relying solely on human oversight or post-development security reviews. Integrating security into the AI coding process and providing developers with tools that embed data protection are seen as essential steps to address these emerging challenges. The shift towards AI-driven development necessitates a reevaluation of security strategies, focusing on proactive measures that align with the realities of modern software engineering. Without such changes, organizations risk exposing themselves to significant security threats stemming from the very tools designed to enhance their productivity.
Jun 29, 2026
The rapid adoption of AI-powered code generation tools such as GitHub Copilot, ChatGPT, and Amazon CodeWhisperer has fundamentally changed the software development landscape, introducing new security challenges for enterprise application security teams. Unlike traditional human-written code, AI-generated code often lacks clear provenance, making it difficult to verify its origin or ensure compliance with organizational security policies. This shift has led to the emergence of 'shadow code'—machine-generated code that may bypass standard security reviews and evade detection by traditional static and dynamic analysis tools, increasing the risk of invisible vulnerabilities in production systems. Generative AI models can introduce unique threats, including the creation of 'hallucinated' packages—references to non-existent or malicious libraries that may be inadvertently included in enterprise applications. Additionally, the language-based nature of large language models (LLMs) opens new attack surfaces, such as prompt injection and jailbreaking, where malicious inputs can manipulate model behavior or bypass safety constraints. As organizations accelerate the integration of AI into development workflows, application security programs must adapt to address these novel risks and build trust in the security of AI-powered software.
Jun 29, 2026