AI Code Vulnerabilities: Risks That Grow With Your App's Scale

Post Views: 10

The AI code vulnerabilities that grow with your app Theori developed 28 applications using AI coding agents and evaluated each through its security testing platform. The projects utilized models from Anthropic and OpenAI, with code generated from specifications, informal prompts, and refactored legacy PHP code.

Initial Findings

The initial expectations centered on common injection flaws such as SQL injection and cross-site scripting, but these were minimal. The models inherently employed prepared statements and ORMs while sanitizing inputs.

CTO Insights

Andrew Wesie, CTO at Theori, attributed this to the simplicity of these vulnerabilities, which require straightforward fixes and clear indicators.

System Resource Exhaustion

The most prevalent issue across 21% of the assessments was system resource exhaustion and denial-of-service risks. Unbounded pagination, absence of rate limiting, and synchronous processes that halted operations were consistently present.

Impact on System Stability

These flaws directly impacted system stability, leading to excessive costs or service disruptions. Wesie noted that such vulnerabilities demand a deeper understanding of system constraints, such as expected request rates and file size limits, which are often not codified.

Secrets Exposure

Secrets exposure accounted for nearly half of critical findings. Hardcoded API keys, default authentication tokens, and insecure JWT configurations persisted in code generated from templates.

Root Causes

These issues originated from quick-start frameworks that lack rigorous security checks.

Access-Control Flaws

Access-control flaws revealed trends based on application scale. In smaller projects, insecure direct object references (IDOR) made up 11% of issues, while a refactored content management system showed 28% of vulnerabilities.

Complexity in Large-Scale Applications

The complexity of enforcing consistent access controls across large-scale applications created gaps in security.

Actionable Vulnerabilities

Initial scans identified 8,827 potential issues. After eliminating duplicates and validating with proof-of-concept exploits, 434 vulnerabilities remained. These were deemed actionable by the team.

Human Oversight in Code Review

Human oversight remains critical in code review processes. The volume of AI-generated code has intensified the need for automation, but Wesie emphasized that automated tools must focus on line-by-line security checks while humans handle strategic decisions.

Role of Automation

Threat modeling, architectural reviews, and high-level security assessments require human expertise. Automation should complement, not replace, these tasks, with tools demonstrating low false positives and effective, sustainable fixes.

Measuring Real-World Impact

Wesie stressed the importance of measuring whether these systems address real challenges rather than consuming resources without value.

Evolving Security Landscape

The study highlights the evolving landscape of AI-assisted development, where new vulnerabilities emerge alongside traditional flaws. As applications scale, security practices must adapt to address systemic risks and maintain robust defenses.

“The volume of AI-generated code has intensified the need for automation, but Wesie emphasized that automated tools must focus on line-by-line security checks while humans handle strategic decisions.”