Topic starter
01/08/2026 10:50 pm
TL;DR: A benchmark of five popular AI coding agents found 69 vulnerabilities across 15 generated applications, with recurring failures in authorization, business logic, SSRF, missing CSRF protection, and absent security headers, according to Tenzai. The result is that AI-assisted development increases delivery speed without reliably adding security judgment, so testing and explicit guardrails now matter more than prompt polish.
Editorial analysis by NHI Mgmt Group, based on content published by Tenzai: “Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents”.
By the numbers:
- Five popular coding agents were benchmarked across 15 generated applications, producing 69 vulnerabilities in total.
Key questions
Q: What breaks when AI coding agents are allowed to ship code without security constraints?
A: Teams get working software that can still carry old, well-known vulnerabilities back into production.
Q: Why do AI coding agents struggle with authorization and business logic?
A: Because those controls depend on context, not just syntax.
Q: What are the signs that AI-generated application code has weak access control?
A: Look for tables exposed without effective policies, permissive access conditions, authentication that blocks legitimate users, and unexplained access to sensitive actions such as bulk email or account deletion.
Practitioner guidance
- Define security acceptance criteria before generation Write authorization, CSRF, header, and rate-limit requirements into the feature brief so the agent has explicit non-functional constraints to satisfy.
- Review every role-based code path manually Check object ownership, role branches, and fallback logic in generated APIs, especially where a missing check could expose another user’s data or actions.
- Test ambiguous workflows with abuse cases Use negative tests for quantities, prices, SSRF targets, and unauthenticated requests because these are the cases agents are most likely to mishandle.
Bottom line: AI coding agents can accelerate development while still leaving critical security controls out of the code path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
AI coding agents create a security debt problem, not just a code-quality problem. The central issue is that they optimize for task completion and feature delivery, while security controls often depend on explicit governance intent. When the prompt does not encode the control, the control is frequently absent. For practitioners, the operational conclusion is that secure software delivery must assume AI will accelerate both code volume and control omission.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations trust prompt engineering to make coding agents safer?
A: No. Better prompts can help when the secure pattern is obvious, but they do not reliably solve ambiguous security problems such as business logic, authorization, or control omission. Organisations need guardrails, code review, and security test gates because prompt quality is not a substitute for assurance.
👉 Read our full editorial: AI coding agents keep shipping vulnerable code across apps