AI-generated code often looks correct.

It compiles. Tests pass. It follows existing patterns.

But correctness and security are not the same. Here are the most common patterns where AI-generated code passes tests and still introduces risk.

#Pattern 1: Injection surfaces

AI is good at writing queries. It is less reliable at writing safe queries.

#Node/TS

• string concatenation in SQL or NoSQL queries
• unsafe eval or dynamic require based on user input
• template injection in server-side rendering

#Python

• f-strings or .format() in SQL
• subprocess calls with shell=True
• unsafe pickle, yaml.load, or exec usage

What to check: every place user input reaches a query, command, or parser.

#Pattern 2: Authentication without authorization

AI often adds login but forgets permissions.

• a new API endpoint checks req.user but not req.user.role
• a Django view uses @login_required but misses object-level permissions
• a Next.js route handler verifies the session but not the resource ownership

What to check: after auth is confirmed, is access controlled?

#Pattern 3: SSRF and unsafe outbound requests

AI frequently suggests “fetch this URL” without constraints.

• a webhook endpoint accepts any URL
• a “health check” pings a user-supplied address
• a file upload fetches a remote image without validation

What to check: is the URL constrained? Are internal ranges blocked?

#Pattern 4: Secrets and data exposure

• debug endpoints that return process.env or os.environ
• logs that print headers, tokens, or request bodies
• error responses that include stack traces with internal paths
• comments containing copied configuration or tokens

What to check: is sensitive data leaving the system in logs, errors, or responses?

#Pattern 5: Weak cryptography

• Math.random() used for security-sensitive IDs
• MD5 or SHA1 used where collision resistance matters
• hardcoded initialization vectors
• password hashing without salt or with weak algorithms

What to check: is the crypto primitive appropriate for the use case?

#Pattern 6: Missing input validation

AI generates endpoints that accept generous input shapes.

• missing length limits on strings
• missing type checks on JSON payloads
• missing file type validation on uploads
• missing rate limiting on sensitive actions

What to check: are inputs validated before they are used?

#Pattern 7: Unsafe defaults

• CORS configured too broadly
• sessions with overly long expiration
• cookies without Secure or HttpOnly
• APIs returning verbose errors in production

What to check: does the configuration match the environment’s risk level?

#The Cyblox view: automate pattern detection in PR

GenAI Code Security scans for these patterns pre-merge:

• injection primitives
• authn/authz gaps
• SSRF and unsafe request patterns
• secrets and data exposure
• weak cryptography
• missing validation
• unsafe configuration defaults

Findings are surfaced in PR review with severity and recommended fixes.

More at: /solutions/security/genai-code-security/.

#Closing thought

Tests validate behavior. Security validates constraints.

AI is good at behavior. It still needs help with constraints.

If AI-generated code is entering your repos, add pre-merge security, secrets, licensing, and policy checks—with review evidence—without changing how developers work.