SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

87% of AI-Generated Pull Requests Contain Security Vulnerabilities, Studies Find

0
·1 views

Multiple studies and developer reports reveal that AI-generated code carries serious security risks at alarming rates, with 87% of pull requests in one DryRun Security study containing at least one vulnerability. Veracode's GenAI Code Security Report found that 45% of unreviewed AI-generated code samples include at least one OWASP Top 10 vulnerability, with Java code failing security checks at a 72% rate. Recurring flaws include broken access control, hardcoded secrets accidentally committed to repositories, and hallucinated package names that attackers can register to deliver malicious code. Researchers tracking CVEs linked to AI coding tools recorded 35 new ones in March 2026 alone, with estimates suggesting the true figure could be five to ten times higher than officially reported. Security experts attribute the problem to AI models optimising for functional output rather than secure design, since they only implement what is explicitly requested in a prompt.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

How the N+1 Problem Silently Slows Laravel GraphQL APIs and How to Fix It

The N+1 query problem is a common performance issue in GraphQL APIs built with Laravel, where a single query triggers one additional database call for each item in a list. For example, fetching 20 articles with their authors can generate 21 separate SQL queries instead of just two. In REST APIs, eager loading with explicit 'with()' calls makes the problem visible in code, but in GraphQL the risk is structural because relations are resolved automatically per request. The Lighthouse package for Laravel addresses this by default through its standard relation directives such as @belongsTo and @hasMany, which batch all required keys and execute a single grouped query. However, the problem can resurface with custom resolvers for computed fields like average ratings, where naive implementations still execute one database query per list item.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Open-Source Firewall for AI Agents After Near-Miss Database Deletion

A developer built an open-source security gateway called Bastion Gateway after a research AI agent nearly dropped a production database table, stopped only by a 403 error. The tool was designed to address two unguarded layers in the developer's Agent OSI model: identity and governance. Bastion Gateway works by enforcing per-agent allowlists, stripping sensitive data from outbound payloads, holding destructive actions for human approval, and maintaining a signed, immutable audit log. Every agent decision is recorded in an ed25519-signed JSON log following the Compliance-as-Code evidence spec, intended as verifiable proof for auditors and compliance teams. The self-hosted version is free and available on GitHub under the Apache-2.0 license, with a hosted version offering additional features currently on a waitlist.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Single Responsibility Principle: Why Each Class Should Do Only One Thing

The Single Responsibility Principle (SRP), part of the SOLID design guidelines, states that a class should have only one reason to change. Developers often bundle multiple functions — such as validation, password hashing, database storage, and email sending — into a single class for convenience, which makes the code fragile and hard to maintain. When a change in one area, like updating an email template, risks breaking unrelated logic such as data validation, debugging becomes time-consuming and error-prone. SRP addresses this by splitting responsibilities into dedicated classes, each handling a single concern, which improves testability, clarity, and flexibility. The practical result is that swapping out one component, such as an email provider, no longer risks introducing bugs in unrelated parts of the codebase.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Engineer Tests IAM and Lake Formation Auth Differences for Glue and S3 Tables Endpoints

AWS Community Builder Aki conducted hands-on tests to verify how IAM policies and Lake Formation grants affect access to the Glue REST Catalog and S3 Tables Iceberg REST endpoints. According to AWS documentation, the Glue endpoint requires both IAM and Lake Formation authorization, while the S3 Tables endpoint relies on IAM alone. The experiment used a matrix of four permission combinations — varying IAM and Lake Formation grants independently — to observe how each endpoint responded with HTTP 200 or 403 status codes. CloudTrail logs were also examined to confirm whether the lakeformation:GetDataAccess API call was triggered, revealing the internal authorization flow for each endpoint. The findings aimed to validate whether Lake Formation is genuinely enforced on the Glue side and confirm the simpler IAM-only path for S3 Tables.

0 comments Read more at DEV Community
87% of AI-Generated Pull Requests Contain Security Vulnerabilities, Studies Find · ShortSingh