New research finds that modern AI coding models frequently generate insecure code that exposes AI-generated applications to denial-of-service attacks, hardcoded secrets and authorization failures.
The rapid adoption of AI coding assistants has transformed software development, enabling developers to generate production-ready applications in minutes rather than days. But as organizations increasingly rely on AI-generated code, a new question has emerged: what kinds of security flaws are these systems introducing?
A new study from our research team at Xint.io analyzed 28 AI-coded applications spanning multiple development workflows, AI models and programming environments to identify which vulnerability classes appear most frequently—and how those vulnerabilities change as applications become more complex. After validating findings through source-code verification and runtime testing, researchers identified 434 verified security vulnerabilities, offering a detailed look at the specific security flaws that tend to show up in AI-generated software.
We evaluated three common AI-assisted development workflows that reflect real-world scenarios:
● Applications generated from detailed specifications
● Greenfield applications created from minimal prompts using a “build this” approach
● A production application that AI was asked to modernize and harden
The findings suggest that today’s leading large language models consistently generate weaknesses involving operational resilience, authentication and complex IDOR, and hard-coded secrets. The types of vulnerabilities change as the apps being created get larger and more complex. But injection flaws (SQLi, XSS) and basic, sing-context IDOR/BOLA-style access-control bugs barely showed up, suggesting that AI labs have genuinely improved in this specific area.
What is AI-generated code doing well?
Our hypothesis was that AI-generated code would repeat many of the industry’s classic programming mistakes, such as SQL injection, cross-site scripting (XSS) and insecure database queries. AI models are trained on large amounts of injection-prone code, so it’s natural to assume they would recreate these flaws.
Instead, the study found the opposite.
Modern models generally default to secure frameworks, parameterized database queries, object-relational mappers and input sanitization, dramatically reducing the frequency of many injection vulnerabilities. Likewise, straightforward authorization checks—such as preventing one user from editing another user’s data—were implemented correctly in most smaller applications. AI code is not repeating yesterday’s vulnerabilities, which indicates the frontier labs have successfully addressed this problem.
Missing controls for rate-limiting or denial of service are most common bugs in AI code?
The largest category of verified findings involved resource exhaustion and denial-of-service (DoS) weaknesses, accounting for 93 of the 434 validated vulnerabilities (21%). Typical examples included:
● Missing rate limiting
● Unbounded pagination
● Synchronous blocking operations
● Poor resource management
These flaws often allow applications to function normally during testing but create significant operational risk once deployed. They can lead to runaway server cost, or a server and attacker can knock over. They were present in almost every project analyzed, but attackers typically must meet certain conditions to exploit them.
These efficiency and performance are rarely mentioned in prompts or example code used to train AI models. Consequently, models optimize for producing working functionality rather than software that continues operating safely under heavy or malicious workloads.
Secret exposure is the top source of high-severity bugs
Although denial-of-service weaknesses were the most common vulnerability overall, the picture changed when we isolated only critical-severity findings.
Among 23 critical vulnerabilities identified in newly generated applications, nearly half involved hardcoded or predictable application secrets, including default encryption keys, JWT signing secrets and embedded credentials. These accounted for 11 critical findings, making secret exposure the single most common critical vulnerability category.
These weaknesses may stem from common coding patterns in publicly available training data. Many tutorials, sample repositories and quick-start applications include placeholder secrets intended to be replaced before deployment. Because those values rarely prevent software from functioning correctly, AI models often reproduce them unchanged.
These defaults can allow attackers to forge authentication tokens, hijack sessions or compromise entire applications. The report also identified critical instances of debug-mode exposure and dependency-related remote code execution, suggesting that development configurations remain another area where AI-generated software requires careful review.
More complex applications create different security issues
One of the study’s notable findings is that application size influences the types of vulnerabilities AI introduces.
Smaller greenfield applications generally exhibited relatively few authorization failures. Instead, they were dominated by missing operational controls such as rate limiting and resource management. As application complexity increased, however, the dominant vulnerability shifted toward authorization and insecure direct object reference (IDOR) flaws. Within the larger production application analyzed in the study, authorization issues represented 66 of 238 verified findings (28%), compared with just 22 of 196 findings (11%) in smaller generated applications.
We believe that AI models handle simple ownership checks well because the required logic is localized. Granular permission models, however, require reasoning across hundreds of endpoints, multiple user roles and changing application state. As software grows, maintaining those relationships consistently becomes substantially more difficult for current AI systems.
The result is software that correctly enforces permissions in straightforward scenarios while quietly introducing privilege escalation opportunities in more complex workflows.
Methodology
To isolate vulnerability patterns, our team evaluated three common AI-assisted development workflows:
● Applications generated from detailed specifications
● Greenfield applications created from minimal prompts using a “build this” approach
● A production application that AI was asked to modernize and harden
The greenfield applications were generated using multiple models from Anthropic and OpenAI, while the production scenario involved migrating a mature PHP content management system to Laravel and React.
Each application underwent automated source-code and runtime analysis followed by manual validation.
The workflow began with 8,827 raw detections, which were reduced through automatic deduplication to 513 distinct findings. Researchers then verified approximately 85% of those findings against source evidence, confirming 434 vulnerabilities for inclusion in the analysis. Findings that could not be verified were excluded.
Limitations of the report are the relatively small per-model sample sizes and the absence of a human-written software baseline. Results should be interpreted as comparative observations rather than statistically significant model rankings.
AI-generated code is improving — but not in every area
Despite documenting hundreds of vulnerabilities, this research offers evidence that AI coding systems are improving in several important areas.
Compared with expectations based on earlier generations of code-generation tools, the study found substantially fewer SQL injection, cross-site scripting and straightforward authorization flaws than anticipated. Models increasingly adopt secure defaults such as prepared statements and built-in input sanitization without explicit prompting.
That evolution suggests foundation model developers have successfully reduced several long-standing vulnerability classes. At the same time, the study indicates that AI-generated software introduces different categories of risk that become increasingly important as organizations expand AI-assisted development.
Why AI makes these mistakes and what to do about it
Our hypothesis is that these vulnerabilities reflect the incentives under which current AI models are trained. Language models primarily optimize for generating code that compiles, passes basic tests and satisfies functional requirements.
Operational safeguards—including rate limiting, resource quotas, timeout management and complex authorization logic—go beyond this scope. And they’re not usually included as explicit functional requirements when prompting the models to generate code.
Our report doesn’t prove this hypothesis, but it matches up with our general observations across AI-assisted software engineering. Models frequently optimize for the “happy path” while overlooking exceptional conditions, runtime abuse scenarios and long-term operational resilience.
The findings suggest organizations should adjust security review processes to account for the distinct characteristics of AI-generated code rather than relying solely on traditional secure coding checklists. Instead of focusing on injection vulnerabilities, security reviewers should prioritize:
● Rate limiting and resource consumption
● Hardcoded credentials and application secrets
● Fine-grained authorization logic
● Runtime behavior under load
● Object-level permission enforcement
● Dependency and debug configuration reviews
We also recommend validating AI-generated applications using both source-code analysis and runtime testing, since many vulnerabilities become apparent only when applications execute under realistic operating conditions.
For product security teams, AI-assisted development may also require introducing new controls into the software development lifecycle, including automated secret detection, authorization testing, policy-based code review and continuous application security testing before deployment.
Rather than eliminating secure code review, AI appears to be shifting where reviewers should focus their attention. As software teams generate more code than human reviewers can realistically inspect manually, security processes will likely need to evolve alongside AI-assisted development itself.
Author: Juno Im, Security Research Engineer, Xint.io
