Why won't automated scanners catch AI code security issues?

Automated scanners catch known and low-hanging-fruit vulnerabilities from established databases. The security issues found in AI-generated code are typically logic failures and incorrect trust assumptions — not traditional bugs with CVE numbers. These require manual penetration testing that mirrors real attacker behaviour, asking the question: what happens if someone does the wrong thing on purpose?

What are the most common security risks in AI-generated code?

The most common risks include: trusting user-supplied input without server-side validation, broken or missing access control where any logged-in user can access other users' data, feature-level security applied piecemeal rather than as a system-wide pattern, missing rate-limiting on non-obvious endpoints, and no consideration of abuse cases or malicious user behaviour. AI builds what you ask for and protects what you explicitly mention — it does not secure the system as a whole.

Does more detailed prompting make AI-generated code more secure?

More detailed, OWASP-based prompts do reduce the number and severity of vulnerabilities in AI-generated code. However, in Infinum's experiment, even the most carefully prompted app still missed CSV injection, rate-limiting on certain endpoints, and open redirect vulnerabilities. Specific prompts help but cannot replace security-aware developers and manual testing.

Short story long

Q: Is AI-generated code secure?

AI-generated code can be secure, but it requires deliberate security guidance, experienced engineering review, and manual penetration testing. In a controlled experiment by Infinum, even apps built with detailed OWASP-based prompts contained vulnerabilities including missing rate-limiting, CSV injection risks, and open redirects. AI reproduces security patterns but cannot reason about system-wide trust assumptions or anticipate creative misuse by attackers.

Pen Testing, Red Teaming, and Why No Scanner Can Replace Either

Pen testing and red teaming are often used interchangeably. They're not. Here's what each actually does, when you need which, and why automated scanners can't replace either.

Silhouette of a person in front of a glowing red screen displaying lines of code, illustrating the security risks of AI-generated code

Is AI-Generated Code Secure? What Business Leaders Need to Know About AI and Application Security

We asked AI to build three web apps with different levels of security guidance, then tried to break them. Here’s what we found.

Why Model Context Protocols (MCP) Will Define the Next Wave of AI-Enabled Businesses

Organizations are adopting AI fast, but the next step is giving models live data and safe ways to act. Model Context Protocols (MCPs) provide that infrastructure—connecting AI to real-time information and verified actions.

Security Gaps in Vibe-Coded Applications

An evaluation of AI-generated code security found that while detailed security prompts lead to improved outcomes, consistent vulnerabilities and gaps remain even with strict guidance.

From RAG to Riches: Strengthening Your Cloud AI Foundation with Databricks

When AI workloads scale, cloud-native tools fall short on governance, versioning, and observability. Databricks fills those gaps without replacing your cloud.

AI Automation: What It Is and How AI-Powered Workflow Helps Your Business

Discover what AI automation is and how it helps your business boost efficiency, streamline workflows, and make smarter data-driven decisions.

Your Brand Needs a ChatGPT App Strategy, Now

The new era of apps is conversational. ChatGPT-native apps are redefining how users discover, interact with, and transact with digital products, and Infinum is ready to help brands lead this shift.

What Consumers Really Think About Their Smart Devices

Research reveals which smart devices consumers actually own and enjoy. Explore IoT ownership trends and satisfaction rates in our data-driven analysis.

Industry insights delivered to your inbox.

Smart Connected Devices – Product and Marketing Guidelines

Our research provides actionable product development and marketing guidelines for smart devices based on user personas.

Smart Devices User Personas: Four Types of IoT Consumers

Our research reveals four distinct IoT consumer personas to help you tailor smart device development and marketing strategies for maximum market adoption.

How Consumer Lifestyle Influences IoT Adoption

Our research reveals how different lifestyles dramatically influence smart device adoption – with implications that every IoT product developer should know.

Unlocking the Business Value of IoT Data

As IoT devices generate more data than ever before, the question is no longer how to collect it – but how to use it.

Apple’s Quiet AI Revolution: What On-Device AI Means for the Future of iOS Apps

Apple’s new On-device AI unlocks powerful, private, and cost-efficient features for iOS apps. Here’s what product teams need to know.

Your Next Best Hire Might Be an AI Agent — Ivan Burazin on Delivered

Tech entrepreneur and AI agent whisperer Ivan Burazin appears in our event series Delivered to discuss the agentic AI revolution.

How AI Went from Buzz to ‘Buzz off While I Generate This’

AI's early days were filled with lofty promises, fears of domination, and hopes of revolution. Two years later, the hype cycle has moved on.

The AI Honeymoon Is Over — Josh Harguess on Delivered

AI and machine learning expert Dr. Josh Harguess discusses how to successfully navigate the post-hype AI landscape.

Revolution or Reboot? Decoding the AI Transformation

From steam engines to smartphones, each innovation redefines our world. Is AI the final revolution, or just the next step in our transformation journey?

Want an AI Invoice Processing Solution? Create It Yourself

Explore our step-by-step guide for building a simple solution for AI invoice processing using Vertex AI and App Script.

AI Security and Governance — Jonathan Dambrot on Delivered

AI security leader Jonathan Dambrot discusses how to successfully navigate the complexities of the AI landscape in 2024.

Generative AI vs Responsible AI – An Ethical Balancing Act

Exploring the relationship between generative AI vs responsible AI. Find out how gen-AI can actually support more responsible AI development.