Study finds AI-generated code often compiles but fails security checks

·9 views

Veracode's 2026 tests found AI models produced code that compiled almost every time but failed security checks on about 44% of tasks, with no meaningful improvement since 2025. Earlier research on GitHub Copilot found roughly 40% of generated programs were vulnerable, and a 2023 study showed developers using AI assistants wrote less secure code while feeling more confident in it. Models also frequently suggested nonexistent software packages, which attackers could exploit by publishing malicious ones under those names. Experts recommend treating AI output like code from an unfamiliar contractor, with careful review, security scanning, and testing before production use rather than banning the tools.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CogniPrep adds three hub pages explaining assessment tests to new users

CogniPrep recently launched three hub pages aimed at people unfamiliar with assessment vendors. Two cover the same subject for different markets: a British English page on psychometric tests for UK graduate schemes, and a US English page on pre-employment tests organised by role type. A third page covers game-based assessments across vendors and is market-neutral. The author notes the two regional pages differ in substance, not just in a find-and-replace of spelling. Some shared components, such as footer labels, URL slugs and schema.org markup, still carry mixed spelling because regional pages cannot override them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Munchable adds an eighth condition, exposing how hardcoded counts drifted out of sync

Munchable, a tool that checks packaged food against digestive-condition rule sets, expanded from seven conditions to eight. A single commit touched 63 files, and a dozen of the changes were one-line edits replacing the spelled-out word "seven" in copy across the app, docs, and shared packages. The author notes the number had been scattered through the codebase as literal text rather than derived from the data. A test checking the phrase also hardcoded "seven", so it kept passing despite the copy becoming wrong. The fix was to compute the count from the condition registry and have the tests import the same constant the pages render.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Header Normalization Can Create Column Collisions in Order CSV Files

An order file containing both 'Order ID' and 'order_id' can become ambiguous if header names are trimmed and normalized before lookup construction. When two columns map to the same key, the value used for an order reference may depend on which column overwrote the other. The proposed remedy is to validate the full header set before mapping rows, rejecting ambiguous normalized names outright. The author, of YX Fulfillment, presents a JavaScript example that applies NFKC normalization, trimming, lowercasing, and whitespace-to-underscore replacement, and throws on duplicate keys or missing required fields. The example is described as an independent file-adapter check rather than a production connector.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Bakeoff on Switch to pick one of several competing pull requests

A developer ran the Switch agent platform headless on a small cloud server to help a team choose among several AI-generated pull requests for the same issue. Switch's maintainer had said only one PR would be selected per issue, after a hackathon left its repository with nearly 400 open PRs. The developer's tool, Bakeoff, opens a Switch chat room whenever two or more PRs reference the same issue, where two agents from different vendors review each diff against the issue's checklist. A maintainer then picks a winner, a person approves the merge through an approval card, and the other PRs receive notes listing the checklist items they missed. The post walks first-time users through Switch's setup, including Docker Compose configuration, agent enrollment, and agent roles, and describes several snags encountered along the way.

0 comments Read more at DEV Community