Why AI-Generated Code Fails Security Reviews 45% of the Time
SMRTR summary
A junior developer, eight months into her first job, watched AI coding tool Copilot slash her workload dramatically. An admin dashboard budgeted for three days? Done in an afternoon. Then, six weeks later, a security tester found that any logged-in user could view every customer's full billing history just by changing a single number in a URL.
That story puts a human face on a striking statistic circulating in security circles: roughly 45% of AI-generated code contains at least one known vulnerability. Research from Veracode, testing over 100 large language models across 80 programming tasks, found that security failure rates have barely budged in two years, even as the models grew measurably smarter at actually solving coding problems.
Perhaps most unsettling is a separate finding: developers using AI assistance wrote less secure code than those working without it, yet felt more confident in their work.
The fix, researchers suggest, is surprisingly simple. Just ask. Explicitly prompting a model for secure code dramatically improves results. The capability is there. Nobody's requesting it.
SMRTR provides this summary for quick context. The original article belongs to DZone.
Read the original article