AI coding agents still miss OS-level security gaps in generated code

At a glance

What this is: Sonar tested Claude Fable 5 on a real Java codebase and found that it produced working code quickly but still introduced a HIGH-severity insecure temporary directory and insufficient test coverage.

Why it matters: For IAM, NHI, and application security teams, the key issue is that agentic coding outputs can be functionally correct while still creating exploitable paths that only runtime quality controls catch.

By the numbers:

• The model produced 1,222 lines of working code in roughly 13 minutes.
• SonarQube Cloud found 10 issues total across the pull request.
• Coverage on new code landed at 76.7% against an 80% threshold.

👉 Read Sonar's analysis of Claude Fable 5, insecure temp storage, and quality gates

Context

AI coding agents can generate apparently working software fast, but speed does not remove the need for security and quality governance. This article is about the gap between code that passes basic execution tests and code that still embeds weak temporary-file handling, deprecated API use, and incomplete coverage.

The security lesson is broader than one Java module. When an AI system writes code, the risk is not only bad logic but also missed environmental assumptions, especially around filesystem behaviour, runtime concurrency, and secure defaults. That matters to identity teams wherever automation is used to build services that handle secrets, tokens, API keys, or other sensitive runtime data.

Key questions

Q: What breaks when AI-generated code skips secure temp-directory handling?

A: A file-upload flow can appear to work while still writing sensitive artefacts into a shared or attacker-influenced location. That creates exposure to symlink abuse, time-of-check-time-of-use races, and content substitution on systems where temp storage is not isolated. The failure is environmental, so tests often miss it unless they simulate hostile host conditions.

Q: Why do AI coding agents still need security gates after functional tests pass?

A: Functional tests prove that the code executes the expected path, not that it is safe under adversarial conditions. Security gates catch issues such as insecure temp paths, deprecated APIs, and under-tested branches before merge. Without that control loop, agentic workflows can scale defect generation faster than reviewers can inspect the code.

Q: How do security teams know whether generated code is actually safe to ship?

A: They should look for policy compliance before commit, not just scan results after commit. A safe-enough threshold requires secure generation rules, dependency provenance checks, and runtime reachability validation so teams can see whether a flaw is theoretical or reachable in the live stack.

Q: How should organisations decide when to allow autonomous coding agents?

A: Allow autonomy only when the task is bounded, reproducible, and reversible. If the work can change multiple files, call external tools, or run in cloud environments, it needs stronger scoping, monitoring, and rollback readiness. Higher autonomy should always require higher assurance, not just faster delivery.

Technical breakdown

Why AI-generated code can look correct while still being unsafe

A coding agent can satisfy the visible functional requirement and still miss low-level security constraints because it is optimising for plausible completion, not exhaustive threat modelling. In this case, the code handled filenames defensively and built a working upload flow, but it failed on secure temporary-directory handling. That matters because adversarial risk often lives in the runtime environment rather than in the request payload itself. Training data helps with common input-validation patterns, but operating-system semantics, shared filesystem behaviour, and race conditions require explicit security reasoning that a model may not infer reliably from source code alone.

Practical implication: Treat successful compilation and passing tests as necessary but not sufficient for AI-generated changes.

Temporary directories and the hidden filesystem attack surface

Temporary directories are often treated as harmless implementation detail, but they can become a security boundary when uploaded files or intermediate artefacts are staged there. The single-argument createTempDirectory call uses the system default temp location, which may be world-writable or shared across processes, creating room for symlink manipulation or time-of-check-time-of-use races. The problem is not the word temporary. The problem is that the storage location and permissions are not explicitly constrained. SonarQube flagged this because the vulnerability exists even when the code appears normal in review.

Practical implication: Force sensitive staging paths into secured directories with restrictive permissions and review every temp-file path as an attack surface.

Why quality gates still matter for agentic development workflows

Quality gates provide the missing feedback loop for code that is generated autonomously or semi-autonomously. In this experiment, the model built code without seeing the security threshold it would later violate, so it could not self-correct against the security rating or coverage target. That is the structural issue with agentic development: the agent can iterate within the session, but it does not automatically inherit the organisation's control objectives. Human review alone also struggles here because the failure may only appear under adversarial conditions or in runtime environments that are not reproduced locally.

Practical implication: Require automated security gates on every AI-generated pull request before merge decisions are made.

Threat narrative

Attacker objective: The attacker aims to exploit insecure temporary-file handling to redirect, tamper with, or expose sensitive uploaded data.

1. Entry occurs when the code generator creates a file-upload workflow that stages user content in the default system temporary directory.
2. Escalation follows when shared-host filesystem semantics allow an attacker or adjacent process to interfere with the staged path or substitute content.
3. Impact is the exposure or redirection of sensitive uploaded material, including logs that may contain credentials or command-line secrets.

NHI Mgmt Group analysis

AI-generated code creates a verification problem, not just a coding problem. The key risk is not that the model cannot write functional code, but that it can produce code that behaves correctly while still violating runtime security assumptions. That makes deterministic quality gates a governance requirement, not a nice-to-have, because human reviewers cannot reliably spot every OS-level or environment-specific weakness. Practitioners should assume agentic development increases the burden on automated verification.

Secure temporary storage is a governance control, not an implementation detail. The insecure temp-directory finding shows a specific failure mode: the application trusted the default filesystem context rather than constraining where sensitive artefacts could live. That is a control-gap pattern teams should recognise in file-upload services, build pipelines, and any workflow that stages secrets or logs before processing. The practical conclusion is to treat staging locations as controlled assets, not generic scratch space.

Training-data familiarity does not cover every threat class equally. The model defended against filename traversal because it had likely seen that pattern many times, yet it missed an operating-system race condition that requires different domain knowledge. That asymmetry matters for AI governance because teams often overestimate how much general security understanding a model has when it is only reproducing common code patterns. Practitioners should validate both input handling and environment handling with equal weight.

Quality infrastructure remains the best available compensating control for agentic coding. The experiment shows that ordinary code-quality tooling already catches many AI-generated defects without any AI-specific configuration. That should shift procurement and governance conversations away from whether an agent can write code and toward whether the organisation has deterministic controls to catch unsafe output before merge. Practitioners should align AI coding workflows to existing NIST CSF, OWASP, and secure SDLC controls rather than treating them as a separate class of risk.

What this signals

Default temp storage becomes a governance issue whenever automation handles sensitive artefacts. In agentic development and broader identity-adjacent workflows, the question is not whether the code runs, but whether the surrounding operating environment enforces the right boundaries. That is why secure SDLC controls and runtime hardening need to be evaluated together, especially when code paths may touch secrets, logs, or uploaded credentials.

AI-generated code will keep exposing familiar and unfamiliar defects at the same time. Some findings will look like classic developer mistakes, while others will come from environmental assumptions that the model does not fully understand. For programmes managing service accounts, API keys, and other machine credentials, that means the security baseline must include both code analysis and identity lifecycle controls such as the Ultimate Guide to NHIs , Key Research and Survey Results.

The operational signal to watch is whether your pipeline can stop unsafe output before merge without relying on a human reviewer to notice every hidden path. If it cannot, the programme is already accepting risk at machine speed.

For practitioners

• Enforce secure temp-directory handling Require every file-upload or staging workflow to use an explicitly secured parent directory with restrictive permissions, not the system default temp location. Review any use of createTempDirectory or similar APIs as a security decision, especially where uploaded logs, archives, or generated artefacts may contain secrets.
• Gate AI-generated pull requests with deterministic checks Make quality gates mandatory for all agent-generated code, including coverage thresholds, security rules, and branch protections that block merges when findings exceed policy. A working build is not an approval signal when the agent cannot reason about adversarial conditions.
• Review filesystem semantics in code review Add a review step that checks shared-host and container filesystem assumptions, including whether temp volumes are shared across processes and whether symlink or TOCTOU conditions are possible. This is especially important for services that process credentials, tokens, API keys, or sensitive logs.
• Track AI-generated defect patterns separately Tag findings from agent-generated code so you can see which defect classes recur, such as deprecated API use, duplicated literals, insecure temp paths, and under-tested branches. That lets security and engineering teams distinguish model strengths from the control gaps it repeatedly exposes.

Key takeaways

• AI coding agents can produce plausible code that still violates environment-level security assumptions, so functional correctness is not a safe proxy for release readiness.
• The experiment surfaced a HIGH-severity insecure temporary-directory issue and sub-threshold coverage, proving that deterministic controls still find defects the model misses.
• Teams should harden temp-path handling, enforce pull-request quality gates, and treat agent-generated code as a governed input to the SDLC.

Key terms

• Agentic Coding Workflow: An agentic coding workflow is a development process where an AI system can generate code, choose tools, and trigger actions such as package installation. The security issue is delegated authority, because the agent may inherit permissions and secrets that a human would normally review.
• Insecure Temporary Directory: A temporary storage location that is writable or shared in ways that allow interference, substitution, or disclosure of files. In security terms, it is risky when the application relies on default system temp paths without isolating permissions, ownership, and race-condition resistance.
• Quality Gate: An automated release control that blocks code when it fails security, test coverage, or maintainability thresholds. It converts review criteria into deterministic enforcement, which is especially important when code is produced by AI systems that may not self-detect environmental or adversarial weaknesses.

What's in the full article

Sonar's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact code path that triggered java:S5443 and how SonarQube Cloud mapped it to insecure temporary-file handling.
• The full list of 10 findings across security, maintainability, and coverage, including the specific rule IDs.
• The comparison between two repeated runs and how the higher-severity defects changed from one execution to the next.
• The concrete compliant fix patterns for secure temp directories and restrictive permissions.

👉 Sonar's full post includes the specific rule mapping, repeat-run differences, and the secure temp-directory fix details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in the contexts that matter to secure automation. It gives identity and security practitioners a practical framework for governing systems that create, use, or expose credentials.