AI coding tools have revolutionized software development in recent years, promising to boost productivity and efficiency. However, as organizations increasingly rely on these tools, security risks are emerging that may outweigh the benefits of AI-generated code. A growing body of research suggests that AI-coded applications are vulnerable to a range of issues, from OWASP Top 10 vulnerabilities to secrets being leaked through hardcoded credentials.
According to GitLab’s 2026 AI Accountability Report, 91% of organizations are using two or more coding tools, and 54% use three or more. While this may indicate widespread adoption, it also raises concerns about the potential security risks associated with AI-generated code. Some developers choose to “vibe code,” which involves using natural language to code software nearly entirely, without necessarily understanding how to program or how computer code works.
Studies have shown that while developers experience productivity gains when using AI coding tools, they often lack trust in the quality of the generated code. In fact, SonarSource’s State of Code Developer Survey 2026 found that only 48% of developers always check AI-generated code before committing it to production. This raises alarm bells for security experts, who warn that AI-assisted or generated code should be reviewed by a skilled developer to ensure it doesn’t contain obvious vulnerabilities.
One of the main concerns is that AI models train on massive repositories and libraries of insecure code, which can perpetuate existing vulnerabilities. Research has shown that up to 45% of AI-generated code samples contain OWASP Top 10 vulnerabilities, although the exact percentage may vary depending on the study. Moreover, there’s evidence that attackers are targeting organizations by publishing malicious packages with hallucinated names.
Veracode’s research last year highlighted the issue of secrets being leaked through hardcoded credentials in AI-coded applications. This is a longstanding problem that has been exacerbated by the rise of AI coding tools. Ben MartinMooney, product marketing manager at GitGuardian, warns that the use of AI coding assistants increases the secrets incidence rate by approximately 40%. In fact, his company’s research found that Claude Code-assisted commits leaked secrets at 3.2%, compared to a 1.5% baseline across all public GitHub commits.
The intersection of AI code and security is becoming increasingly complex, with experts warning about the potential for slopsquatting, where attackers publish malicious packages with hallucinated names. As organizations continue to rely on AI coding tools, it’s essential that they also prioritize security and review generated code carefully. This means keeping a skilled developer in the loop to ensure that AI-coded applications don’t contain obvious vulnerabilities or secrets.
Ultimately, the benefits of AI-generated code must be weighed against the potential risks. While productivity gains may be significant, organizations should not overlook the security implications of relying on these tools. As the use of AI coding assistants continues to rise, it’s crucial that developers and security experts work together to mitigate the risks associated with AI-coded applications.
For readers who are considering implementing AI coding tools in their organization, our advice is to proceed with caution. While these tools may promise significant productivity gains, they also introduce new security risks that must be carefully managed. Always keep a skilled developer involved in reviewing generated code and ensure that you have robust security measures in place to mitigate the potential vulnerabilities associated with AI-coded applications.
Source: Dark Reading — 2026-07-10