Security of AI-generated code
Across security-relevant scenarios, a substantial share of assistant-generated code contained known classes of vulnerability. Tools and models change the proportion, and the structural point stands. Generated code has a vulnerability profile that is checked as a class, and is not to be assumed safe because it reads fluently.
Evidence grade: research Peer-reviewed or large-sample empirical work supports it.
Use it when
The checklist for generated code; scanning aimed at the known failure modes on the paths where a vulnerability would cost most.
Where it stops working
It is a point-in-time study of one tool. The rate is not stable, and the class-level risk is.
Where the standard uses it
- TJ-3Code review and quality standardsIncluding standards for AI-generated code.
- TJ-5AI-assisted engineeringAdoption, governance, capability-building, and risk.
- TJ-6Security, privacy, and compliance as engineering responsibilitiesOwned by engineering, not delegated to a function.
Sources
- Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt and Ramesh Karri. Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions. IEEE Symposium on Security and Privacy, 2022. In the bibliography
Used alongside it
- AI-assisted developer productivity contested
- Aligned autonomy practice
- Code review as knowledge transfer research
- Compliance as a programme practice
- Contract at the boundary practice
- Privacy by design practice
Cite this model
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Security of AI-generated code. In Engineering Management Academy Body of Knowledge (Version 3.1, TEC.security-of-ai-generated-code). https://www.engineeringmanagement.academy/body-of-knowledge/techniques/security-of-ai-generated-code