# Is AI-written code safe?

Date: 2026-10-28 · Author: Robert Scales · https://guidetoartificialintelligence.com/en/learn/is-ai-written-code-safe/

**Answer:** Not by default. Studies keep finding that AI models write working code with security holes in a large share of cases, and that people trust that code more than they should, so AI-written code is only as safe as the review, tests and limits you put around it.

AI coding tools are very good at producing code that runs. Running and being safe are different things, though. A login form can work perfectly for honest users and still let an attacker read every account in the database. The research so far points the same way: models often pick the insecure way of doing something, and the people using them tend not to notice.

That does not mean you should stop using AI to write code. It means you treat AI output like code from a fast, eager new colleague who has never been told your security rules: useful, often right, and always reviewed before it touches real users or real data.

## Why does AI code go wrong on security?

A language model learns to write code from huge amounts of public code, and a lot of public code is insecure. When you ask for "a page that shows a user's orders," the model writes the shortest path to orders on a screen. Unless you ask, it may not check that the person asking is the person who owns those orders, escape text before showing it, or keep a key out of the browser.

Three patterns show up again and again:

- **Missing checks.** Input isn't validated, user text is shown without escaping (which opens the door to cross-site scripting, where an attacker's script runs in someone else's browser), or the server trusts whatever the browser sends.
- **Leaked secrets.** API keys and passwords end up in front-end code or in a public repository.
- **Invented or risky dependencies.** The model imports a package (a ready-made code library) that is outdated, or one that doesn't exist at all.

## A quick review routine for AI-written code

You don't need to be a security expert to catch the most common problems. Before you accept a change, run through this table, or paste the prompt below into a second AI session to do a first pass.

| Check | What to look for | Why |
|---|---|---|
| Who can do this? | Every page or API route that reads or changes data checks the logged-in user on the server | Checks done only in the browser can be skipped |
| What comes in? | User input is validated and escaped before use | Blocks injection and cross-site scripting |
| Any secrets? | No keys, tokens or passwords in the code | Code gets copied, shared and published |
| New packages? | Each new dependency exists, is popular and is maintained | Invented names can be claimed by attackers |
| Tests? | A test proves the unsafe case fails (another user's data is refused) | "It works" only proves the happy path |

```prompt
You are a careful security reviewer. Review the code below as if it will run on a public website with real user data.
List, in order of severity:
1. Any place where a user could read or change data that isn't theirs.
2. Any user input that is used without validation or escaping.
3. Any secret (key, token, password) that appears in the code.
4. Every external package it imports, and whether you are certain it exists.
For each problem, quote the line, explain the risk in plain words, and propose a fix. If you are unsure, say so.
[paste the code]
```

A second AI review is a helpful filter, not a guarantee. It catches many obvious slips; it can also miss things or flag false alarms, so treat its list as a to-do list for you to verify.

> **Try it:** Ask an AI assistant to "write a small web page where users can view their saved notes," then run the review prompt above on its answer in a fresh chat. Count how many of the five checks the first version passed without being asked.

## What do the studies actually show?

**Models often choose the insecure option.** In July 2025, the security company Veracode published its GenAI Code Security Report. It gave more than 100 language models 80 coding tasks, each of which could be completed safely or unsafely, and scanned the results. In 45% of cases the code contained a vulnerability from the OWASP Top 10, a widely used list of the most serious web security risks. Java fared worst, failing more than 70% of the time; Python, C# and JavaScript failed between 38% and 45%. The models failed to guard against cross-site scripting in 86% of the relevant tasks. Veracode also reports that newer models write more correct code but have not become more secure. Keep in mind that this is a vendor's own test with its own scanner, so the exact numbers depend on its method.

**People trust AI code more than they should.** A Stanford study by Perry and colleagues, first posted in 2022, asked participants to solve security-related programming tasks, some with an AI assistant based on an early OpenAI Codex model. Those with the assistant wrote significantly less secure code and were also *more* likely to believe their code was secure. Participants who trusted the AI less and reworked their prompts did better. The tools have improved a lot since then, but the human side of the finding, that confident-looking code lowers our guard, still matters.

**Models invent packages, and attackers can use that.** Spracklen and colleagues, in a paper accepted at the USENIX Security Symposium 2025, generated 576,000 code samples in Python and JavaScript with 16 popular models. On average, at least 5.2% of packages suggested by commercial models and 21.7% by open-source models did not exist; they counted 205,474 distinct invented names. An attacker who publishes malicious code under a name that models tend to invent can get it installed by anyone who trusts the suggestion. That is why "check that every new package exists and is the one you meant" is on the review table.

Taken together, the studies don't say AI code is worse than human code in every case; they say it fails in predictable ways, and that our confidence rises faster than its quality. The fix is the same routine professionals use for any code: state your security requirements in the prompt, keep humans reviewing anything that handles logins, personal data or money, and let tests, not impressions, decide whether a change is ready.

## Sources

- AI-Generated Code Poses Major Security Risks in Nearly Half of All Development Tasks, Veracode Research Reveals: https://www.veracode.com/press-release/ai-generated-code-poses-major-security-risks-in-nearly-half-of-all-development-tasks-veracode-research-reveals/
- Do Users Write More Insecure Code with AI Assistants?: https://arxiv.org/abs/2211.03622
- We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs: https://arxiv.org/abs/2406.10279