Why AI writes plausible code, not secure code

AI coding assistants are trained to predict the most likely next tokens, which means they produce code that looks plausible and usually runs. Looking right and running are not the same as being secure. The training data is a mix of good and bad public code, so a model happily reproduces the same insecure patterns that fill tutorials and old forum posts.

That leads to a specific kind of risk. The output is fluent, confident, and often almost correct, which makes reviewers relax exactly when they should stay alert. A snippet that concatenates user input into a query, stores a password in plain text, or disables certificate checking will run fine in a demo and fail only when an attacker arrives.

Three habits keep this in check:

Assume plausible, verify secure. Fluency is not evidence. Judge code on what it actually does with untrusted input, secrets, and permissions.

Know the model has no context on your threat model. It does not know which inputs are attacker-controlled, which data is sensitive, or what your compliance rules require, unless you tell it.

Slow down on the security-relevant lines. Auth, input handling, crypto, and anything touching secrets or the network deserve a closer read than boilerplate.

The productivity gain from these tools is real. It survives only when a human keeps ownership of whether the code is safe, not just whether it works.