Source: https://www.intigriti.com/blog/news/owasp-top-10
Modern software development practices have incorporated artificial intelligence coding assistants, resulting in increased engineering productivity. Developers use these emerging tools to develop applications, create boilerplate routines, query databases, and implement complex application programming interfaces (API). Despite the potential for increased productivity, research in the field of software security shows that artificial intelligence coding assistants introduce security flaws at a higher rate than human developers. Code produced using artificial intelligence tools presents vulnerabilities that are worth consideration when compared to industry standards such as the Open Worldwide Application Security Project (OWASP) Top 10. When compared to code written by humans, code written by AI coding assistants introduces OWASP Top 10 security flaws at a rate 2.7 times higher. The main reason behind this trend is the inability of models to grasp context when generating code. Large language models (LLMs) that power AI coding assistants predict the next likely token using a probabilistic model that draws from information culled from public repositories used to train the models. As a result, the code produced by AI coding assistants is often functional but lacks key security hardening measures. Empirical tests of code security using large language models (LLMs) and web and API security criteria show that models fail specific defensive programming areas by an average of over 80 percent. Of the OWASP Top 10 categories of security flaws, broken access control and injection flaws account for the highest percentage of vulnerabilities in code produced by AI coding assistants. Failure to enforce access control occurs when the code generated by an AI coding assistant does not require the requesting application or user to demonstrate possession of valid credentials or authorization to access a specific resource. This weakness is prevalent in code generated by AI coding assistants because the functionality demonstrated when testing a web application built with the code works as expected. This observation is particularly common when a developer tests their own code using a demo with a valid user account and accesses data that should be restricted to specific users. Similarly, injection flaws are also high in code generated by AI coding assistants. This weakness is particularly worrying because it has been observed across all categories of injection, including server-side request forgery, path traversal, and SQL injection. The problem arises when the developer using an AI coding assistant does not sanitize user input before the code uses the input to access a database or execute a system command. Cryptographic failures and security misconfigurations are also common in code produced by AI coding assistants. The issue stems from the fact that developers using AI coding assistants rely on default configurations. Default configurations are often insecure and are, therefore, a source of weaknesses in code produced with AI coding assistants. Additionally, there is a concerning trend of hallucination in code produced by AI coding assistants. Some AI coding assistants suggest packages that do not exist or have imaginary vulnerabilities and weaknesses, and developers implementing the recommendations unknowingly introduce weaknesses or expand attack surfaces by using packages with typosquatting names that exist in package managers. Automation bias causes developers to trust the security of code produced by AI coding assistants, resulting in poor code reviews and weak pull request approvals. Addressing the issue of OWASP Top 10 weaknesses in code produced by AI coding assistants requires developers to adopt new practices that treat AI coding assistants as advanced text generation tools. Developers should invest in static application security testing (SAST) and perform code reviews with fresh eyes after making changes to incorporate new features or hotfixes for reported production issues. Additionally, developers should invest in tools that scan application programming interface (API) dependencies for known weaknesses and ensure that architectural risk assessments are performed before deploying applications using code produced with AI coding assistants. Sources: https://www.veracode.com/ https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html https://appsecsanta.com/research/ai-code-security-study-2026