Why AI-generated code ships with security flaws, and what to do about it

It is one of the more uncomfortable numbers in software right now. Independent studies keep landing near the same place: about 45% of AI-generated code ships with a known security weakness. Roughly 84% of developers now use AI coding tools, yet close to 46% say they do not trust the output. Independent research keeps finding that around 45% of AI-generated code ships with a known security weakness.

That is not a reason to stop using AI to write code. It is a reason to understand why it happens, so you can catch it.

Why it happens

AI writes what looks right

A model predicts plausible code. Plausible and secure overlap a lot, but not completely, and the gap is exactly where vulnerabilities live. An authentication check that looks correct but misses one condition is extremely plausible, which is why it slips through.

It learned from imperfect code

Models learned from enormous amounts of real-world code, and a great deal of real-world code has flaws. Insecure patterns that were common in the training data show up in the output, including outdated libraries and old ways of doing things that have known problems.

It has no view of your whole system

Security often depends on context the model cannot see: which data is sensitive, who is allowed to touch it, what the rest of your app assumes. Code that is fine in isolation can be unsafe in your specific system, and the model was never shown your system.

Which flaws follow from those three causes

Each cause produces a predictable kind of omission. Writing what looks right produces a missing condition, most often an authorisation check. Learning from imperfect code produces dated patterns and unsafe query construction. Having no view of your system produces rules that scope nothing, because the model never knew who was allowed to see what.

The full catalogue of what that looks like in practice, class by class, with what it takes to establish each one, is a separate page: it is a reference rather than an argument, and it is kept current.

What to do about it

The answer is not to hand-audit every line. It is to check the small set of things that go wrong most, against evidence, on a regular basis. Scan dependencies, verify access control on every request, keep secrets in configuration, and confirm the boring production basics are actually in place.

StackAttest automates most of that check. It reads your live app and repository, looks for exactly these weaknesses, and gives you a scored, shareable result so a fixed problem is one you can prove is fixed.