↓ Skip to main content
sdd.sh
sdd.sh
  1. Articles/

92% of AI-Generated Codebases Have Critical Vulnerabilities. Here's Why Agentic Review Is the Fix.

·1927 words·10 mins·
Florent Clairambault
Author
Florent Clairambault
CTO & software engineer — writing daily about spec-driven development and agentic coding
Table of Contents

The numbers are in, and they’re uncomfortable. ProjectDiscovery’s 2026 AI Coding Impact Report surveyed 200 cybersecurity practitioners across North America and Western Europe. Every single respondent — 100% — reported increased engineering delivery over the past year. Nearly half attributed most or all of that acceleration to AI-assisted coding tools.

And 62% of those same security teams said keeping up with that volume is getting harder.

A separate analysis from Sherlock Forensics found that 92% of AI-generated codebases contain at least one critical vulnerability. The average AI-coded application has 8.3 exploitable findings. Seven in ten organizations have confirmed or suspected AI-generated security vulnerabilities in production right now.

This is not an argument for slowing down AI adoption. It’s an argument for doing it correctly.

The Specific Failure Modes
#

AI coding tools don’t fail randomly. They fail in patterned, predictable ways that mirror their training data biases and the limitations of autoregressive generation.

The most common vulnerability types in AI-generated code are not exotic. They’re classics:

  • XSS (cross-site scripting): Present in 86% of AI-generated web-facing code according to 2026 analysis
  • Log injection: 88% of LLM-generated code includes at least one log injection vector
  • Business logic vulnerabilities: Cited by 72% of security professionals as a top concern — the kind of flaw where the application does exactly what it was asked to do, but in a way an attacker can abuse
  • Supply-chain risks: 73% flag unsafe or unreliable dependencies introduced by AI-suggested imports
  • Secret exposure: 78% cite the exposure of corporate secrets as their primary concern — API keys, credentials, and internal URLs embedded in generated code or configuration files

The pattern here is instructive. XSS and log injection are textbook OWASP vulnerabilities — the kind of thing that experienced developers know to guard against explicitly. AI models know what these vulnerabilities are in the abstract but routinely generate code that contains them because they’re optimizing for functional correctness in the context window, not for adversarial safety at the application boundary.

Business logic vulnerabilities are harder. They require understanding the intent of a system, not just its syntax. A model that has never been told “this endpoint should only be callable by authenticated admins” will generate a working endpoint that isn’t. It will pass a unit test. It won’t pass a security review.

The Trust Gap Is Growing
#

The April 2026 JetBrains AI Pulse survey found that 84% of developers use AI coding tools — but only 29% trust what those tools produce in production. That gap is not just a perception problem. It’s a measurement of the actual risk that organizations are carrying.

Two-thirds of security teams in the ProjectDiscovery report are spending more than half of their time manually validating AI-generated findings rather than fixing them. This is the worst possible allocation of security effort: skilled engineers doing manual triage because the toolchain can’t distinguish a real critical vulnerability from a false positive.

The irony is that the same AI acceleration causing the problem could be part of the solution — if deployed correctly.

The Agentic Review Loop
#

The response to “AI generates vulnerable code” should not be “generate less code.” It should be “build better review into the generation loop.”

Agentic workflows with structured review stages address this directly. Here’s what that looks like in practice with Claude Code:

Pre-commit security hooks: Claude Code supports hooks that run before any code is committed. A security-focused hook can invoke an MCP tool that runs static analysis against the changed files, catches OWASP top-10 patterns, and blocks the commit if critical findings are present. This moves security left — not to “during review,” but to “before the change leaves the developer’s machine.”

# Example: hook that runs security scan on staged files
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{"type": "command", "command": "run-security-scan.sh"}]
    }]
  }
}

Subagent review architecture: In multi-agent workflows, a dedicated review agent — instantiated with explicit security context — can audit the output of a primary coding agent before it’s merged. Claude Code’s agent teams architecture supports this natively: the orchestrating agent submits code to a review subagent that has been primed with the application’s security requirements, threat model, and known sensitive areas.

Structured CLAUDE.md security rules: Any project using Claude Code can embed security invariants directly in the CLAUDE.md specification. These rules travel with the codebase and apply to every agent session that touches it:

## Security invariants
- Never embed credentials, API keys, or internal URLs in code or comments
- All user input must be sanitized before database insertion or log output
- Authentication checks must appear at the start of every admin endpoint handler
- External dependencies must be pinned to specific versions — no floating semver

When these rules are in CLAUDE.md, they’re not just documentation — they’re active constraints that Claude Code enforces across every session. The CLAUDE.md supply-chain attack (CVE-2026-21852) demonstrated that this mechanism is powerful enough to be worth attacking, which is itself a signal of how seriously the system enforces these rules.

What Security Teams Actually Need
#

The ProjectDiscovery report is explicit about what security practitioners want before integrating AI deeply into their processes: audit trails and access limitations.

Both of these are solved problems in modern agentic tooling. Claude Code’s analytics API provides per-user, per-session data on tool acceptance rates, commands executed, and files modified. OpenTelemetry integration via Claude Cowork lets security teams pipe this data directly into their SIEM. A complete audit trail of what the AI agent did, when, and in which files is not a future feature — it’s available today.

Access limitations are similarly addressable through the MCP permission model. Tools can be scoped to specific operations and specific file paths. An agent working on the frontend should not have an MCP tool that can execute arbitrary SQL. Namespace your MCP tools. Scope your permissions. Apply the principle of least privilege to your agents the same way you apply it to your service accounts.

The Bottom Line
#

The security crisis in AI-generated code is real. 92% of AI codebases with at least one critical vulnerability is not a number to dismiss. But the response can’t be to retreat to fully human-written code — that ship has sailed. 51% of all GitHub commits in 2026 are already AI-assisted or AI-generated.

The fix is architectural:

  1. Move security left — pre-commit hooks, not post-deploy audits
  2. Use agentic review loops — a separate reviewer agent with explicit security priming, not a human manually reading every diff
  3. Encode invariants in specs — CLAUDE.md security rules that travel with the codebase and apply to every session
  4. Instrument everything — audit trails, SIEM integration, and per-user analytics so the security team has visibility without bottlenecking delivery

The goal is not to slow AI down. It’s to build a review infrastructure that can keep pace with AI’s output velocity. That infrastructure is agentic by necessity — because human reviewers cannot scale to match what AI can generate.

The irony is that the most effective defense against vulnerable AI-generated code is more AI, deployed more thoughtfully.

Sources:

June 2026 Update: Three New Attack Classes Confirm the Structural Argument
#

In the two months since this article was published, three distinct security incidents have demonstrated that the threat model for AI coding agents is more expansive than OWASP-class vulnerabilities in generated code. The agent itself is now the attack surface.

Agentjacking: The Sentry MCP Injection (June 24, 2026)
#

Security researchers disclosed a new class of agentic attack dubbed “agentjacking”: prompt injection delivered through legitimate developer tool output rather than crafted user input. The Sentry MCP attack works as follows:

  1. An attacker creates a crafted Sentry error event and submits it via a public DSN (a Sentry endpoint that accepts unauthenticated error reports)
  2. A developer or autonomous agent queries that Sentry project for recent errors
  3. The MCP tool returns the attacker’s event, which contains injected instructions
  4. The AI agent executes those instructions with the developer’s full credential set

In controlled testing, the attack achieved an 85% exploitation rate. 2,388 Sentry-connected organizations were identified as exposed. Claude Code, Cursor, and OpenAI Codex were all confirmed affected. Sentry initially declined to fix the issue at the infrastructure level, citing technical constraints.

The mitigation is sandbox.credentials — the credential sandboxing feature shipped in Claude Code v2.1.187 prevents the injected commands from accessing your actual credentials even if the injection succeeds. CLAUDE.md invariants that restrict which MCP tools can be called, and from which context, provide a second layer.

SymJack + TrustFall: RCE Across Six Agents (May 2026)
#

Adversa AI disclosed two related vulnerabilities in May 2026 (detailed coverage here):

TrustFall (one-click RCE): A malicious .mcp.json file placed in a repository, when opened by an agent, triggers a trust confirmation dialog. If the user clicks “Trust,” the attacker-controlled MCP server is added and can execute arbitrary commands. Affected: Claude Code, Cursor, Gemini CLI, GitHub Copilot.

SymJack (symlink-hijack RCE): An agent that follows a symlink in a malicious repository can be redirected to read or execute files outside the intended directory. Affected across six agentic coding tools.

The Miasma worm, discovered in the Azure/durabletask GitHub repository in May 2026, demonstrated real-world exploitation of SymJack-class techniques to propagate malicious payloads via open-source repositories that developers routinely clone.

Mitigations: treat .mcp.json files in cloned repositories as untrusted; use MCP server allowlists; sandbox agent execution. The sandbox.credentials setting remains the most important first-order defense.

MCP OAuth Token Hijacking (May 23, 2026)
#

Mitiga Labs disclosed a stealth attack targeting the MCP OAuth flow: a malicious npm package with a postinstall script overwrites ~/.claude.json to redirect OAuth tokens for every connected MCP service to an attacker-controlled endpoint. Because MCP OAuth uses bearer tokens, the attack gives the attacker full, persistent access to every service the developer has authorized — GitHub, Salesforce, Sentry, Slack — until tokens are manually revoked.

Token rotation was found to be ineffective as a remediation because the ~/.claude.json override persists across token refreshes. The fix is to audit your installed npm packages and run Claude Code with sandbox.credentials: true to prevent the modified config from being read by sandboxed subagent commands.

A New Mitigation: Workload Identity Federation
#

Anthropic shipped Workload Identity Federation GA in June 2026. Short-lived OIDC tokens replace static sk-ant-... API keys, with support for AWS IAM, GCP, Azure, GitHub Actions, Kubernetes, SPIFFE, and Okta as identity providers.

For the MCP token hijacking vector in particular, WIF is a structural improvement: there are no long-lived static keys to steal. A credential extracted from a WIF-managed environment has a 60-second to 24-hour lifetime, significantly reducing the blast radius of any credential exposure.

The Updated Fix List
#

The four-point architectural fix from April still holds. Add two more:

  1. Treat MCP tool output as untrusted input — prompt injection delivered through third-party tool results (Sentry, GitHub Issues, Jira) is now a documented attack class, not a hypothetical
  2. Migrate from static API keys to Workload Identity Federation — eliminates the long-lived credential that makes OAuth hijacking and secret exposure catastrophic rather than inconvenient

The security crisis in AI-generated code is real. The security crisis for AI coding agents is also real, and it arrived faster than most teams anticipated.

Related