A new study found that modern AI coding models frequently generate insecure code that exposes AI-generated applications to denial-of-service attacks, hard-coded secrets, and authentication failures.
The rapid adoption of AI coding assistants is transforming software development, allowing developers to produce production-ready applications in minutes instead of days. But as organizations increase their reliance on AI-generated code, new questions are arising about what kinds of security flaws these systems are introducing.
A new study by Xint.io’s research team analyzed 28 AI-coded applications across multiple development workflows, AI models, and programming environments to determine which vulnerability classes appear most frequently and how those vulnerabilities change as applications become more complex. After validating their findings through source code verification and runtime testing, the researchers identified 434 verified security vulnerabilities and took a closer look at specific security flaws that tend to appear in AI-generated software.
We evaluated three common AI-assisted development workflows that reflect real-world scenarios.
●Applications generated from detailed specifications
● Greenfield applications created from minimal prompts using a “build this” approach.
● Production applications that need to be modernized and enhanced by AI
This finding suggests that today’s leading large-scale language models consistently generate weaknesses related to operational resiliency, authentication and complex IDORs, and hard-coded secrets. As the apps being created grow larger and more complex, the types of vulnerabilities change. However, injection flaws (SQLi, XSS) and basic single-context IDOR/BOLA-style access control bugs rarely surfaced, suggesting that AI Lab has truly improved in this particular area.
What AI-generated code is working well?
Our hypothesis was that AI-generated code would repeat many of the industry’s classic programming mistakes, such as SQL injection, cross-site scripting (XSS), and unsafe database queries. Since AI models are trained on code that is prone to mass injections, it is natural to assume that these flaws will be reproduced.
In fact, the study found the opposite.
Modern models typically use secure frameworks, parameterized database queries, object-relational mappers, and input sanitization by default, which significantly reduces the frequency of many injection vulnerabilities. Similarly, simple authorization checks, such as preventing one user from editing another user’s data, were successfully implemented in most small applications. AI code is not repeating yesterday’s vulnerabilities. This shows that Frontier Labs has successfully addressed this problem.
Are the most common bugs in AI code missing rate limiting or denial of service controls?
The largest category of results verified was for resource exhaustion and denial of service (DoS) vulnerabilities, accounting for 93 (21%) of the 434 vulnerabilities verified. Typical examples include:
● No rate limits
● Unlimited pagination
● Synchronous block operations
● Poor resource management
Although these defects allow applications to function normally during testing, they often pose significant operational risks after deployment. Server costs can spiral out of control, and servers and attackers can go down. Although these were present in almost all analyzed projects, they typically require certain conditions to be met for an attacker to exploit them.
These efficiencies and performance are rarely mentioned in prompts or sample code used to train AI models. As a result, the model is optimized to produce functional functionality rather than software that continues to operate securely under heavy or malicious workloads.
Secret exposure is the number one cause of high-severity bugs
Denial of service vulnerabilities were the most common vulnerabilities overall, but the situation changed when we isolated only critical severity consequences.
Of the 23 critical vulnerabilities identified in newly generated applications, nearly half involved hard-coded or predictable application secrets, such as default encryption keys, JWT signing secrets, and embedded credentials. These accounted for 11 critical findings, making security exposure the most common critical vulnerability category.
These weaknesses may be due to common coding patterns in publicly available training data. Many tutorials, sample repositories, and quickstart applications include placeholder secrets that are intended to be replaced before deployment. These values rarely prevent the software from functioning correctly, so AI models often reproduce them without modification.
These defaults allow an attacker to forge authentication tokens, hijack sessions, or compromise your entire application. The report also identified significant cases of remote code execution related to leaks and dependencies in debug mode, suggesting that development configuration continues to be an area that requires careful review of AI-generated software.
More complex applications introduce different security issues
One notable finding of this study is that application size influences the types of vulnerabilities introduced by AI.
Small greenfield applications generally experienced relatively few authentication errors. Instead, they mostly lacked operational controls such as rate limiting and resource management. However, as application complexity has increased, the primary vulnerabilities have shifted to authentication and insecure direct object reference (IDOR) flaws. In the large-scale production applications analyzed in this study, authorization issues accounted for 66 of 238 (28%) verified results, but in the small-scale produced applications, they accounted for only 22 of 196 (11%) verified results.
We believe that AI models can handle simple ownership checks well because the necessary logic is localized. However, a detailed permission model requires inference across hundreds of endpoints, multiple user roles, and changing application states. As the software grows, it becomes significantly more difficult for current AI systems to maintain these relationships consistently.
The result is software that correctly enforces privileges in simple scenarios while silently introducing privilege escalation opportunities in more complex workflows.
methodology
To isolate vulnerability patterns, our team evaluated three common AI-assisted development workflows.
●Applications generated from detailed specifications
● Greenfield applications created from minimal prompts using a “build this” approach.
● Production applications that need to be modernized and enhanced by AI
The greenfield application was generated using multiple models from Anthropic and OpenAI, while the production scenario included migrating a mature PHP content management system to Laravel and React.
Each application was manually verified through automated source code and runtime analysis.
The workflow started with 8,827 raw findings, which were reduced to 513 distinct findings through automatic deduplication. The researchers then verified approximately 85% of these findings against source evidence, identifying 434 vulnerabilities to include in their analysis. Findings that could not be verified were excluded.
Limitations of this report are the relatively small sample size per model and the absence of a human-written software baseline. Results should be interpreted as comparative observations rather than rankings of statistically significant models.
AI-generated code is improving, but not in all areas
This study provides evidence that AI coding systems are improving in several key areas, despite hundreds of documented vulnerabilities.
Compared to expectations based on previous generations of code generation tools, this study found significantly fewer SQL injection, cross-site scripting, and simple authentication flaws than expected. Models increasingly adopt safe defaults, such as prepared statements and built-in input sanitization, without explicit prompting.
This evolution suggests that the developers of the underlying model have succeeded in reducing several long-standing classes of vulnerabilities. At the same time, this study shows that AI-generated software poses different categories of risks that are becoming increasingly important as organizations expand their AI-assisted development.
Why AI makes these mistakes and what to do about them
Our hypothesis is that these vulnerabilities reflect the incentives under which current AI models are trained. Language models are primarily optimized to produce code that compiles, passes basic tests, and meets functional requirements.
Operational safeguards such as rate limits, resource quotas, timeout management, and complex authorization logic are beyond this scope. Additionally, these are typically not included as explicit functional requirements when prompting the model to generate code.
Although our report does not prove this hypothesis, it is consistent with general observations across AI-assisted software engineering. Models often optimize toward a “happy path” while ignoring exceptional conditions, runtime abuse scenarios, and long-term operational resilience.
This finding suggests that organizations should adjust their security review processes to account for the distinct characteristics of AI-generated code, rather than relying solely on traditional secure coding checklists. Rather than focusing on injection vulnerabilities, security reviewers should prioritize:
● Rate limits and resource consumption
● Hardcoded credentials and application secrets
● Fine-grained authentication logic
● Runtime behavior under load
● Enforcing object-level permissions
● Review dependencies and debug configurations
We also recommend validating AI-generated applications using both source code analysis and runtime testing, as many vulnerabilities are only revealed when the application is run under realistic operating conditions.
For product security teams, AI-assisted development may also require introducing new controls into the software development lifecycle, such as automated sensitive detection, authorization testing, policy-based code reviews, and continuous application security testing before deployment.
Rather than eliminating secure code reviews, AI appears to be shifting reviewers’ attention to where they should be. As software teams generate more code than human reviewers can realistically manually inspect, security processes will likely need to evolve alongside AI-assisted development itself.
author: Juno Im, Xint.io Security Research Engineer
