TOPIC 03 OF 05
Insecure AI-generated code
Treat code as untrustedGenerated code can contain vulnerable dependencies, exposed secrets, unsafe defaults, missing authorization, injection flaws, invented APIs, weak error handling, or tests that confirm the wrong behavior. Working code is not the same as secure code.
An assistant builds a file-upload endpoint that trusts the filename, accepts every file type, stores files publicly, and has no size limit. The happy path works, but the system creates several attack paths.
Never run unfamiliar generated commands or code with production credentials or broad permissions. Prompting the model to ‘make it secure’ does not replace threat modeling, review, testing, and dependency controls.
Use least privilege, isolated testing, secret scanning, dependency review, static analysis, adversarial tests, peer review, and staged deployment.