Choose Wisely: AI-Generated Coding Risk Varies, A Lot
A Secure Code Warrior study revealed that AI-generated code introduces a significant number of vulnerabilities – an average of 15 per codebase – but the risk varies greatly depending on the development framework used. The study, based on testing 1,760 codebases from 16 leading AI models, found that no single model consistently outperformed others, and that vulnerabilities were more predictable based on the combination of model and framework. Organizations should prioritize security training and gatekeeping for high-risk frameworks, focusing on common vulnerabilities like data leakage and session management, rather than attempting to cover every potential issue.
A Secure Code Warrior study has highlighted the complex security landscape of AI-generated code. Researchers evaluated 1,760 complete codebases generated by 16 leading AI models, including those from OpenAI, Anthropic, and Google, to assess the security risks associated with using these tools. The study found that AI-generated code contained an average of 15 confirmed vulnerabilities per codebase, with 4.3 of those classified as critical or high severity.
However, the research indicated that the risk wasn't uniform across all models. Anthropic's Claude models (Sonnet 5 and Fable 5) scored best, with OpenAI's GPT 5 Mini performing the worst. Crucially, the study revealed that a model's performance was highly dependent on the development framework it was paired with – JavaScript and Java EE/JSP were identified as particularly high-risk frameworks, while C# and Java Spring exhibited lower vulnerability rates.
Researchers noted that vulnerabilities were often predictable and stemmed from common oversights, such as missing authentication checks and inadequate input validation, rather than intentionally malicious code. The study emphasized that organizations should prioritize security training and implement gatekeeping measures for teams working with high-risk frameworks. Specifically, they identified 17 Common Weakness Enumerations (CWEs) that consistently appeared across all models, recommending a focus on mitigating vulnerabilities related to sensitive data leakage, cross-site scripting, hard-coded credentials, predictable session tokens, and reset codes – issues that AppSec teams have been addressing for years.
Secure Code Warrior CEO and co-founder Pieter Danhieux advises that while organizations can't dictate a team's framework choice, they can enforce security requirements for high-risk environments, mirroring the scrutiny applied to other critical systems.