Insecure AI-generated code

Also called: vibe-coded vulnerabilities

DEFINITION

Code a model writes can compile, run, and still contain security holes — unsanitised input, path traversal, hardcoded secrets, outdated dependencies — because it reproduces patterns from its training, insecure ones included.

WHY IT MATTERS

Generated code arrives looking finished, which makes people skip review. The same scrutiny you'd give a stranger's pull request applies — arguably more, since the author can't explain its choices.

COMMONLY CONFUSED WITH

Broken code. This code often works perfectly for the happy path; the danger is the input the author didn't consider.

SOURCES

Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1U.S. National Institute of Standards and Technology · 2023-01-26

First-pass citations, limited to primary sources; a reviewer will broaden and verify these before this entry leaves draft.