Is AI-generated code secure?

AI-generated code can be secure, but it requires deliberate security guidance, experienced engineering review, and manual penetration testing. In a controlled experiment by Infinum, even apps built with detailed OWASP-based prompts contained vulnerabilities including missing rate-limiting, CSV injection risks, and open redirects. AI reproduces security patterns but cannot reason about system-wide trust assumptions or anticipate creative misuse by attackers.

Why won't automated scanners catch AI code security issues?

Automated scanners catch known and low-hanging-fruit vulnerabilities from established databases. The security issues found in AI-generated code are typically logic failures and incorrect trust assumptions — not traditional bugs with CVE numbers. These require manual penetration testing that mirrors real attacker behaviour, asking the question: what happens if someone does the wrong thing on purpose?

What are the most common security risks in AI-generated code?

The most common risks include: trusting user-supplied input without server-side validation, broken or missing access control where any logged-in user can access other users' data, feature-level security applied piecemeal rather than as a system-wide pattern, missing rate-limiting on non-obvious endpoints, and no consideration of abuse cases or malicious user behaviour. AI builds what you ask for and protects what you explicitly mention — it does not secure the system as a whole.

Does more detailed prompting make AI-generated code more secure?

More detailed, OWASP-based prompts do reduce the number and severity of vulnerabilities in AI-generated code. However, in Infinum's experiment, even the most carefully prompted app still missed CSV injection, rate-limiting on certain endpoints, and open redirect vulnerabilities. Specific prompts help but cannot replace security-aware developers and manual testing.

Author at Infinum

Author

Sean McCarthy

Pen Testing, Red Teaming, and Why No Scanner Can Replace Either

Pen testing and red teaming are often used interchangeably. They're not. Here's what each actually does, when you need which, and why automated scanners can't replace either.