The real risks: what AI code tends to get wrong
A short field guide to the vulnerability classes that show up most often in generated code.
Generated code fails in predictable ways. Knowing the short list lets you scan for it fast. The industry reference point is the OWASP Top 10, refreshed for 2025, and the categories below map to the ones that surface most in AI output.
Injection. User input concatenated into SQL, shell commands, or HTML. The model reaches for string building because it is common in its training data, not because it is safe.
Broken access control. Endpoints that check that you are logged in but never that you are allowed to touch this specific record. Generated CRUD code often skips the ownership check entirely.
Cryptographic failures. Weak hashing for passwords, hard-coded keys, outdated algorithms, or homegrown crypto instead of vetted libraries.
Security misconfiguration and insecure defaults. Debug mode left on, permissive CORS, verbose error messages that leak internals, or wide-open cloud permissions.
Secrets in code. Keys and connection strings pasted directly into source, which then flow into version control.
None of these are exotic. They are the everyday failure modes of hurried code, and an assistant reproduces them at speed. The value of naming them is triage: when you review generated code, you are not looking for every possible bug, you are checking these high-frequency classes first, on the lines that handle untrusted input and sensitive data.
Pick one file an assistant helped you write. Walk the five classes above and note which ones even apply to that file. For each that applies, mark the exact line you would check.
Enjoying the free lessons? Get an email when we publish new courses and updates — no spam, unsubscribe anytime.
Discussion (0)
Ask a question or share what worked for you. Comments are reviewed before they appear.
No comments yet. Be the first to start the discussion!