Why AI-generated code ships with security flaws, and what to do about it

It is one of the more uncomfortable numbers in software right now. Independent studies keep landing near the same place: about 45% of AI-generated code ships with a known security weakness. Roughly 84% of developers now use AI coding tools, yet close to 46% say they do not trust the output. Independent research keeps finding that around 45% of AI-generated code ships with a known security weakness.

That is not a reason to stop using AI to write code. It is a reason to understand why it happens, so you can catch it.

Why it happens

AI writes what looks right

A model predicts plausible code. Plausible and secure overlap a lot, but not completely, and the gap is exactly where vulnerabilities live. An authentication check that looks correct but misses one condition is extremely plausible, which is why it slips through.

It learned from imperfect code

Models learned from enormous amounts of real-world code, and a great deal of real-world code has flaws. Insecure patterns that were common in the training data show up in the output, including outdated libraries and old ways of doing things that have known problems.

It has no view of your whole system

Security often depends on context the model cannot see: which data is sensitive, who is allowed to touch it, what the rest of your app assumes. Code that is fine in isolation can be unsafe in your specific system, and the model was never shown your system.

The flaws that show up most

• Broken access control, where a user can reach data that is not theirs. This is the most common serious one.
• Injection, where unsanitized input reaches a query or the page.
• Hardcoded secrets, where a key or token ends up in the code or the client bundle.
• Outdated dependencies with known, published vulnerabilities.
• Leaky error handling that exposes internal details to users.

What to do about it

The answer is not to hand-audit every line. It is to check the small set of things that go wrong most, against evidence, on a regular basis. Scan dependencies, verify access control on every request, keep secrets in configuration, and confirm the boring production basics are actually in place.

StackAttest automates most of that check. It reads your live app and repository, looks for exactly these weaknesses, and gives you a scored, shareable result so a fixed problem is one you can prove is fixed.