TL;DR: An AI coding agent can produce working Java code quickly, yet still miss a HIGH-severity insecure temporary directory and fall short on test coverage, according to Sonar’s experiment with Claude Fable 5, which means existing quality gates remain essential even when the code looks correct. The findings also show that training-data patterns do not reliably cover OS-level security knowledge or non-deterministic vulnerability emergence.
At a glance
What this is: Sonar’s experiment found that an AI coding agent could build functional Java code quickly while still missing an OS-level insecure temporary directory vulnerability that a quality gate caught.
Why it matters: For IAM and security teams, the finding is a reminder that generated code can look correct while still carrying hidden control failures, so governance must validate runtime and platform assumptions, not just syntax and tests.
Context
AI coding agents can produce plausible code that passes basic testing while still missing security conditions that live below the application layer. In this case, the gap was not a logic error in the API flow but a temporary-directory decision that created an OS-level exposure the model did not recognise.
For identity and security practitioners, the important lesson is that code-generation speed does not remove the need for enforceable controls around build quality, runtime assumptions, and issue detection. The article also shows a boundary between pattern learning from training data and security knowledge that depends on operating-system behaviour and deployment context.
Key questions
Q: What breaks when AI-generated code skips secure temp-directory handling?
A: A file-upload flow can appear to work while still writing sensitive artefacts into a shared or attacker-influenced location. That creates exposure to symlink abuse, time-of-check-time-of-use races, and content substitution on systems where temp storage is not isolated. The failure is environmental, so tests often miss it unless they simulate hostile host conditions.
Q: Why do quality gates matter for AI-generated pull requests?
A: Because they catch security and maintainability failures that code generation does not reliably avoid. A quality gate checks the artifact against policy, so it can flag insecure temp APIs, low coverage, duplicated strings, and deprecated calls even when the implementation appears correct and the tests pass.
Q: What do security teams get wrong about AI safety testing?
A: The common mistake is treating AI safety testing as if it were just another security scan. It is not. Safety testing is about proving how a model or agent fails under pressure, while traditional security tooling is about who can access the system. Those are different governance questions and need different evidence.
Q: Should teams review AI-generated code differently when it handles files or uploads?
A: Yes. File-handling code deserves a stricter review because the risk sits in the interaction between application logic and the operating system. Teams should check staging paths, permissions, cleanup behaviour, and whether the code depends on predictable temp-directory behaviour.
Technical breakdown
Why insecure temporary directories become a security gap
A temporary directory is not safe simply because its name includes the word temporary. When code uses the default system temp location, it inherits the operating system’s permissions, lifecycle, and concurrency behaviour. On shared hosts or containerised environments, that can expose race conditions, symlink manipulation, or unwanted file placement if the application writes sensitive content into a predictable staging area. The vulnerability here is architectural: the code may compile and pass tests, yet still rely on an unsafe filesystem assumption that only appears under adversarial conditions.
Practical implication: treat temp-file creation as a security control decision, not an implementation detail.
Why generated code can miss OS-level knowledge
AI coding agents are strong at reproducing code patterns they have seen often, such as input sanitisation or path traversal checks. They are weaker when a defect depends on environmental behaviour that is not obvious from the source tree alone, such as how the operating system handles shared temporary directories. That difference matters because the model can reason about filenames while still missing the security properties of the place where those files are written. The result is code that looks cautious in one place and exposed in another.
Practical implication: review AI-generated code for environment-dependent assumptions, especially around filesystem, privilege, and deployment context.
Why quality gates still work for AI-generated pull requests
Static analysis and quality gates remain effective because they do not care whether a human or an AI wrote the code. They evaluate the artifact against defined rules, so they can catch issues that tests do not simulate, including insecure temp APIs, deprecated calls, and logging inefficiencies. That is especially useful for AI-generated pull requests, where the main risk is not only correctness but also hidden insecurity in code that seems to function normally. The control value sits in deterministic enforcement, not author identity.
Practical implication: keep quality gates mandatory for AI-assisted development and do not create a separate trust tier for generated code.
Threat narrative
Attacker objective: The attacker’s objective is to read, alter, or redirect uploaded files through unsafe temporary-directory handling in the generated code.
- Entry occurred through AI-generated application code that used a default temporary directory for uploaded files, creating an OS-level exposure surface.
- Credential or data exposure could follow if an attacker manipulated the temp path or staging area on a shared host before analysis completed.
- Impact would be the disclosure or corruption of uploaded GC logs, including environment details that may contain sensitive runtime information.
Breaches seen in the wild
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI-generated code inherits control gaps from the environment, not just from syntax. This article shows a defect that tests and superficial review can miss because the flaw sits in filesystem behaviour, not application logic. That is why runtime context must be treated as part of the security model, especially when code is assembled by an AI agent. Practitioners should assume generated code can be functionally correct and still deployment-insecure.
Pattern recognition is not the same as security understanding. The model handled familiar problems such as filename sanitisation, but it missed the less visible OS-level condition behind the temporary-directory flaw. That is a useful boundary for the field: training data can reproduce common defensive patterns without reliably modelling where those patterns stop working. Practitioners should use this distinction when evaluating AI-generated pull requests.
Quality gates are now a governance control for AI-assisted development. The article reinforces that static analysis and coverage thresholds are not optional extras once agents start writing code at speed. Existing controls are doing exactly the job they were built for, which is to validate code independently of author intent. Teams should keep AI-generated code inside the same enforcement path as human-authored code.
OS-level insecurity in generated code is a distinct failure mode worth naming. The temporary-directory issue is not just a bug, it is a control gap where the agent failed to translate application intent into safe platform behaviour. That failure mode matters because it will recur anywhere generated code touches files, secrets, or execution paths. Practitioners should treat platform-aware review as part of AI code governance.
The security review burden shifts from creation to verification. When an AI agent can produce working code quickly, the differentiator becomes whether the organisation can systematically catch hidden issues before merge. That moves security from a developer assistance function to a control plane function. Teams should measure whether their verification stack is strong enough for non-deterministic AI output.
What this signals
OS-level security gaps are now a normal review target for AI-generated code. The practical issue is no longer whether the agent can produce functioning code, but whether the organisation can verify the platform assumptions that code makes. That is especially true for upload handlers, temp files, and any workflow that touches the filesystem.
Generated code raises the value of deterministic control enforcement. AI output can vary from run to run, which means the security outcome is not stable enough to trust without a quality gate. Teams should expect the control plane to do the catching, because the model will not reliably self-identify the same hidden defect every time.
For practitioners
- Enforce static analysis on every AI-assisted pull request Require quality gates for generated code before merge, including checks for secure file handling, coverage thresholds, deprecated APIs, and unsafe temporary-path usage.
- Review temporary-file logic for OS-specific assumptions Inspect any code that stages uploads, extracts archives, or writes transient files to ensure it uses a secure parent directory or restrictive permissions rather than the default system temp location.
- Treat AI code review as environment review Check whether the generated implementation depends on shared containers, writable temp paths, or host-specific filesystem behaviour that tests do not simulate.
- Keep human approval on security-sensitive paths Require a security reviewer for code that handles uploads, credentials, or local file creation, even when the AI output appears complete and the test suite passes.
Key takeaways
- AI coding agents can produce functional modules while still missing operating-system security assumptions that only review and analysis tools surface.
- The article’s evidence shows a quality gate can catch an insecure temporary-directory flaw even when tests and basic functionality look good.
- Security teams should keep AI-generated code inside the same static analysis, coverage, and review controls they already use for human-written code.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI05 — Unexpected Code Execution | Generated code changed runtime file-handling behaviour without security awareness. |
| Recommendation — Review agent-generated code for execution paths that introduce unsafe filesystem or runtime behaviour. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Shared temp paths can expose data and enable movement on multi-process systems. |
| Recommendation — Map writable temp-path exposure to TA0006 and TA0008 when assessing host-level abuse paths. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest is Protected | Uploaded files staged in insecure temp locations can expose data at rest before analysis. |
| Recommendation — Apply PR.DS-01 to protect uploaded data wherever the application stages temporary files. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The issue was found in generated application code and caught by secure-code controls. |
| Recommendation — Use CIS-16 to enforce secure code review and static analysis on AI-generated pull requests. | ||
Key terms
- Insecure Temporary Directory: A temporary storage location that is writable or shared in ways that allow interference, substitution, or disclosure of files. In security terms, it is risky when the application relies on default system temp paths without isolating permissions, ownership, and race-condition resistance.
- Quality Gate: An automated release control that blocks code when it fails security, test coverage, or maintainability thresholds. It converts review criteria into deterministic enforcement, which is especially important when code is produced by AI systems that may not self-detect environmental or adversarial weaknesses.
- Operating-System-Level Security Gap: A vulnerability that depends on how the host platform behaves rather than on application logic alone. These gaps often escape ordinary functional tests because they appear only under shared-host, permission, or concurrency conditions that the test harness does not simulate.
- Generated Code Verification: The process of reviewing AI-produced code against security and quality rules before it is merged or deployed. It focuses on evidence, policy, and runtime assumptions, because correct-looking output can still contain hidden flaws that the model did not reason through.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a fit for practitioners who need to govern non-human access, secret handling, and agentic workflows alongside broader security controls.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org