AI generated code most often carries cross-site scripting, log injection, injection flaws, hardcoded secrets, weak access control and invented dependencies. Catch them by layering static analysis, secrets scanning and a dependency check on every pull request, then having a person review authentication, authorization and data handling by hand.
Key takeaways
- In Veracode's 2025 tests, models failed to secure code against cross-site scripting in 86 percent of cases and against log injection in 88 percent.
- Language matters. Veracode reported Java above 70 percent failure, and Python, C# and JavaScript between 38 and 45 percent.
- The model can invent a package that an attacker later registers.
- Scanners catch patterns. People catch logic mistakes.
How common are vulnerabilities in AI generated code?
Common enough to plan for. Veracode's 2025 GenAI Code Security Report ran 80 curated coding tasks across more than 100 models and found vulnerabilities in 45 percent of cases, within the OWASP Top 10. When a model could pick a secure or an insecure method, it chose the insecure one 45 percent of the time.
Veracode also reported that security performance stayed flat over time even as syntax accuracy improved, and that bigger models did not do significantly better. That is one vendor's benchmark, run on its own task set, so use it as a signal.
Which vulnerabilities show up most?
| Weakness | What the AI tends to do | How to catch it |
|---|---|---|
| Cross-site scripting | Writes user input into HTML without encoding | Static analysis, framework safe defaults |
| Log injection | Logs raw input | Static analysis, structured logging |
| Injection | Builds queries by string concatenation | Static analysis, parameterised queries |
| Hardcoded secrets | Places keys and tokens in source | Secrets scanner, push protection |
| Missing access control | Checks login but not ownership | Manual review, tests |
| Hallucinated packages | Imports a name that does not exist | Dependency check before install |
| Risky calls | eval, unsafe deserialization, innerHTML | Pattern rules, review |
What are hallucinated packages and why do they matter?
A hallucinated package is a library name the model made up. A study of 16 code generation models over 576,000 samples reported averages of at least 5.2 percent for commercial models and 21.7 percent for open source models, with 205,474 unique invented names.
The risk is that an attacker registers the name with malicious code. Check any new dependency exists, is the one you meant, and has no known vulnerabilities before you install it. A quick way is gold.safeguard.sh/scan, a free in-browser scan with no login that keeps the file on your machine and covers up to 100 dependencies.
How do you catch these in practice?
Use four layers, from cheapest to most thorough.
- In the editor. Claude Code's security guidance plugin reviews code Claude writes. On each file edit it matches risky patterns such as
eval(,pickleand.innerHTML =. At the end of each turn it runs a separate model review of the diff. Its own documentation says it can miss issues and is one layer, not a complete solution. - On commit. Run a secrets scanner. Gitleaks detects passwords, API keys and tokens in repositories and can run as a pre-commit hook. GitHub push protection can block secrets at push time when enabled.
- On pull request. Run static analysis and a dependency check. Here is an interactive demo of a static code scan.
- In review. A person reads authentication, authorization and data access code.
Click through it at your own pace, or open it full screen.
What does a scanner miss?
Business logic and authorization. A scanner can see that a query is parameterised. It cannot know that user A should not read user B's order. Add tests for ownership checks and read those routes yourself.
Checklist for AI generated code
- Secrets scan on every commit
- Static analysis on every pull request
- New dependencies verified before install
- Tests for access control on every data route
- Human review of auth, payments and data deletion
- Assistant limited to a development environment
Frequently asked questions
Is AI code worse than human code?
The Veracode benchmark found flaws in 45 percent of tasks, but it did not compare against human developers on the same tasks. Scan both the same way.
Can the AI that wrote the code also review it?
It can help, but Claude Code's documentation notes its security plugin uses a separate model call with fresh context rather than the same session grading itself, and it still recommends further layers.
Which language is worst?
Veracode reported Java above 70 percent failure and Python, C# and JavaScript between 38 and 45 percent in its tests.
Do I need a paid tool to start?
No. Gitleaks is MIT licensed, and the dependency scan at Gold is free. Start there and add static analysis.
Sources
- Veracode 2025 GenAI Code Security Report press release: https://www.veracode.com/press-release/ai-generated-code-poses-major-security-risks-in-nearly-half-of-all-development-tasks-veracode-research-reveals/
- Package hallucination study: https://arxiv.org/abs/2406.10279
- Claude Code security guidance plugin: https://code.claude.com/docs/en/security-guidance
- Gitleaks: https://github.com/gitleaks/gitleaks
- GitHub push protection: https://docs.github.com/en/code-security/secret-scanning/introduction/about-push-protection
- Safeguard Gold dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
