AI Agents Built Two Apps, Introduced 143 Vulnerabilities

What Happened

DryRun Security tested three AI coding agents, OpenAI Codex GPT 5.2, GitHub Copilot Workspace, and Replit Agent, on two application builds. The agents generated code for a task management app and a social media platform. Across 30 pull requests and 38 security scans, the AI tools introduced 143 distinct security issues.

Broken access control appeared in every agent's output across both applications. OAuth implementation failures were common. Pattern-based static analysis tools missed most of the logic and authorization flaws.

Timeline

The study doesn't provide specific dates, but the testing methodology followed a clear progression:

1. Initial build: Each AI agent built both applications from scratch.
2. First scan: Security analysis identified vulnerabilities in the generated code.
3. Remediation attempts: Agents were prompted to fix identified issues.
4. Follow-up scans: Multiple rounds of scanning revealed persistent and new vulnerabilities.
5. Final analysis: Codex produced the fewest remaining vulnerabilities in the final scan of both applications, but all agents left security gaps.

Which Controls Failed or Were Missing

Access Control Validation

Every AI agent failed to implement proper authorization checks. The code allowed users to access resources they shouldn't. Your API endpoint might check authentication (is this a valid user?) but skip authorization (should this user access this specific resource?).

OAuth Implementation

Multiple agents botched OAuth flows. They might hardcode redirect URIs, skip state parameter validation, or mishandle token refresh. These aren't edge cases, they're core OAuth security mechanisms defined in RFC 6749.

Input Validation and Sanitization

AI-generated code accepted user input without validation. SQL injection vectors, XSS opportunities, and command injection paths made it through because the agents focused on functionality over security constraints.

Session Management

Weak session handling appeared across agent outputs: predictable session IDs, missing timeout enforcement, inadequate session invalidation on logout.

What the Relevant Standards Require

OWASP ASVS v4.0.3 Section 4.1 requires that access control decisions happen on the server side, using trusted data. Your authorization logic must verify every request against the user's actual permissions, not just check that they're logged in.

Requirement 4.1.2 specifically states: "Verify that access controls fail securely including when an exception occurs." AI agents don't think about exception handling in authorization logic. They write the happy path.

PCI DSS v4.0.1 Requirement 6.2.4 mandates that custom code is developed securely. If you're using AI agents to generate payment processing code, you're responsible for ensuring it meets the standard's secure coding practices. The AI doesn't know about PCI DSS scope.

OWASP Top 10 2021 A01:2021 - Broken Access Control documents exactly what DryRun Security found. Broken access control moved from fifth position in 2017 to the top spot in 2021 because it's so prevalent. AI agents are now automating this failure at scale.

OAuth 2.0 RFC 6749 Section 10 outlines security considerations. The state parameter (Section 10.12) prevents CSRF attacks during the authorization flow. AI agents skip it because the OAuth flow works without it, until an attacker exploits the missing protection.

Lessons and Action Items for Your Team

Don't trust AI-generated code for security-critical functions

Authorization logic, authentication flows, cryptographic operations, and input validation require human review. Set up your code review process to flag any AI-generated code that touches these areas.

Create a checklist:

• Does this code make authorization decisions?
• Does it handle user input?
• Does it implement authentication or session management?
• Does it use cryptography?

If yes to any, a security engineer reviews it, not just the team lead.

Pattern-based SAST tools won't catch logic flaws

The study found that traditional static analyzers missed the authorization bugs. These tools look for known patterns: SQL concatenation, eval() calls, hardcoded secrets. They don't understand business logic.

You need manual code review for authorization checks. Ask: "What happens if I change the user ID in this request? Can I access another user's data?"

Test authorization boundaries explicitly

Your test suite should include negative cases:

• User A tries to read User B's resource
• User tries to access admin endpoint
• Authenticated user tries to skip payment
• User modifies their own permission level

AI agents write tests for the happy path. They verify the feature works, not that it fails safely.

Document your authorization model

Before you let an AI agent write code, document your authorization rules. "Users can only view their own orders" needs to be explicit in your requirements. AI agents can't infer your security boundaries from feature descriptions.

Create an authorization matrix: which roles can perform which actions on which resources. Reference it in code review.

Implement runtime authorization checks

Use an authorization library or framework that enforces checks at runtime. Don't rely on the AI agent to remember to call checkPermission() before every data access.

In Python, decorators can enforce authorization. In Java, use annotations. In Node.js, middleware can verify permissions before route handlers run.

Audit AI-generated OAuth implementations

If an AI agent implements OAuth for you, verify:

• State parameter generation and validation
• Redirect URI validation against a whitelist
• Token storage (never in localStorage for access tokens)
• Token refresh handling
• Scope validation

Better yet, use a well-tested OAuth library instead of letting the AI write the flow from scratch.

Track which code came from AI agents

Tag AI-generated pull requests. When a vulnerability appears in production, you'll want to know if AI agents are introducing specific vulnerability classes. That data shapes your review process.

James Wickett, CEO of DryRun Security, points to a fundamental gap: AI agents optimize for working code, not secure code. Until training data and models improve, your security review process is the control that prevents AI-introduced vulnerabilities from reaching production.

The speed benefit of AI coding agents is real. So is the security risk. Your job is to capture the speed without shipping the vulnerabilities.