AI coding assistants and insecure code suggestions: what teams should do

TL;DR: An audit of Cursor, GitHub Copilot, Codeium, and Qodo Gen found that all four AI coding tools could generate insecure code across multiple CWE categories, including weak encryption, access control issues, and unsafe execution patterns, according to VirtueAI. The finding is a governance problem, not just a coding quality problem: developers need policy, review, and runtime guardrails around AI-assisted code generation.

NHIMG editorial — based on content published by VirtueAI: How Safe is Your AI Coding Assistant? A Virtue AI Security Audit

Questions worth separating out

Q: How should security teams govern AI coding assistants that can execute commands?

A: Treat them as delegated non-human identities with bounded execution authority.

Q: Why do AI coding assistants create access control risk in applications?

A: Because they often generate code that assumes the caller is trusted or that sensitive fields are safe to expose.

Q: What do security teams get wrong about AI-generated code risk?

A: They often focus on catching insecure output after code is written, which is too late for AI-native workflows.

Practitioner guidance

• Require human review for security-sensitive completions Gate AI-generated code that touches authentication, access control, secrets, logging, serialization, or input parsing behind mandatory review by an engineer who can assess trust boundaries and data exposure.
• Add static analysis to every AI-assisted pull request Scan generated code for unsafe primitives such as eval-like execution, unvalidated string formatting, insecure cryptography, and direct access to sensitive object fields before merge.
• Define an AI coding policy for protected data Specify which fields may never appear in generated code, tests, logs, or templates, and tie that policy to redaction rules for credentials, payment data, and personal information.

What's in the full report

VirtueAI's full research covers the implementation detail this post intentionally leaves for the source:

• Side-by-side code examples for Cursor, GitHub Copilot, Codeium, and Qodo Gen across CWE categories
• The SecCodePLT methodology used to test tab-completion behaviour against insecure prompts
• Concrete examples of how specific completions introduced eval-based execution and sensitive data exposure
• Best-practice examples for automated code review and runtime guardrails in AI-assisted development

👉 Read VirtueAI's audit of AI coding assistant security across four tools →

AI coding assistants and insecure code suggestions: what teams should do?

Explore further

View Full Forum →  |  NHI Foundation Course →