How to Review AI-Generated Code for Security Issues

The Hidden Cost of Shipping AI Code Unreviewed

AI writes code faster than any developer in your organization — and ships security flaws at a pace no team is equipped to catch. Between 84% and 97% of developers now use AI to generate code, with Google DORA pegging adoption at 90%. Yet the security practices surrounding that code have barely moved.

Veracode's analysis of more than 100 LLMs across 80 coding tasks found that 45% of AI-generated code contains security flaws — a rate that has stayed, in Veracode's Chris Wysopal's words, "completely flat" for two years, even as the code's syntax and functionality improved. Prevalence estimates vary with methodology: a large-scale GitHub study found 87.9% of AI-generated code free of CWE-mapped vulnerabilities, while other research puts the flawed share anywhere from 12% to 45%. The honest takeaway: a meaningful slice of AI output is insecure, and nobody knows which slice without looking.

Volume makes it worse. According to GitClear's analysis of GitHub data, developers checked in 75% more code in 2025 than in 2022 — multiplying the surface that needs review. And Google DORA's September 2025 research found that while developers estimate 17% effectiveness gains from AI, software delivery instability rose nearly 10%, with 60% of developers on teams experiencing lower speeds, greater instability, or both.

The core problems compound each other:

• AI reproduces insecure patterns from training data, like string-concatenated SQL queries, because it pattern-matches rather than reasons about security.
• Iterative AI "improvement" without human review increases critical vulnerabilities by 37.6% after just five iterations, per a controlled study.
• Developers accepting or rejecting AI output rather than writing logic erodes code ownership, making flaws harder to spot or fix.

The same trust gap extends beyond raw code to the agent skills that increasingly drive AI coding workflows. Published research found that roughly 26% of AI agent skills carry at least one vulnerability — instruction packages that teams install and execute with little scrutiny. SkillzBench is being built on the opposite premise: verify before trust, security-scanning and version-pinning every skill in its free directory before agents ever see it.

AI-generated code is not going away, and it shouldn't — the productivity is real. But as Veracode's Natalie Tischler puts it: "You wouldn't deploy a new application without scanning it for vulnerabilities. Why treat AI-generated code any differently?" The rest of this article shows you exactly how to audit it.

Why AI Code Fails in Predictable Ways — and Why Iteration Makes It Worse

AI-generated code doesn't fail randomly — it fails in patterns you can learn to spot. According to the Cloud Security Alliance's taxonomy, AI introduces risk in four predictable ways, and knowing them turns security review from guesswork into a checklist.

The four categories:

• Reproduced insecure patterns — models pattern-match against open-source training data and repeat what they saw most, like string-concatenated SQL queries instead of parameterized ones.
• Dangerous optimization shortcuts — the model grabs the shortest path to a working solution, such as calling eval() on user input, which opens the door to remote code execution.
• Omitted security controls — validation, sanitization, authorization, and output encoding simply never appear, because the model is rewarded for solving the task, not reasoning securely.
• Subtle logic errors — a permission check like if "admin" in user.roles silently becomes if user.role == "admin", breaking access for multi-role users while looking perfectly correct.

The consequences are unevenly distributed. Veracode's testing of 100+ LLMs found AI code fails 86% of the time on cross-site scripting and 88% of the time on log injection — the worst offenders by far — while faring much better on SQL injection, where it passes 80% of the time.

Here's the counterintuitive part: iterating makes it worse. A controlled experiment across 400 samples found that five rounds of LLM-driven "improvement" without human review produced a 37.6% increase in critical vulnerabilities — a phenomenon the researchers call feedback loop security degradation. Even security-focused prompts didn't guarantee secure outcomes. The authors' conclusion: "Developers provide essential quality control that automated systems currently cannot replicate."

Language choice matters too. A large-scale GitHub study found Python code is consistently riskiest (16.18%–18.50% of AI-generated Python files carried vulnerabilities), JavaScript sits in the middle (8.66%–8.99%), and TypeScript is safest (2.50%–7.14%). If your stack is Python-heavy, budget extra review time accordingly.

The same verify-before-trust principle applies to the agent skills and instruction packages developers now bolt onto AI coding tools — published research found roughly 26% carry at least one vulnerability. SkillzBench is building a free directory that security-scans, version-pins, and sandbox-benchmarks skills before you equip an agent with them, so the same discipline you apply to generated code extends to the tooling around it.

The Step-by-Step Security Audit Process for AI-Generated Code

AI-generated code fails in predictable ways — which means you can audit it in a predictable way. The workflow below is built around AI's known failure modes, so every step targets a weakness the research has actually documented.

Step 1: Review against the four-category checklist. Before touching any tooling, check the code against the Cloud Security Alliance's taxonomy of AI-introduced risk: repeated insecure training-data patterns (like string-concatenated SQL), dangerous optimization shortcuts (such as eval() on user input), omitted security controls (validation, sanitization, authorization), and subtle logic errors in permission checks. Prioritize XSS and log injection — Veracode found AI code fails 86% and 88% of the time on those two classes respectively.

Step 2: Scan before merge, with extra scrutiny on Python. Embed SAST pre-deployment, DAST for runtime issues, and SCA for dependency risks. Weight your attention by language: a large-scale GitHub study found Python's vulnerability rate runs 16.18%–18.50%, versus 8.66%–8.99% for JavaScript and as low as 2.50% for TypeScript.

Step 3: Verify every AI-recommended dependency. This is where AI code review becomes supply-chain defense. Mandiant documented an attacker who hijacked an active AI coding-assistant session, induced a poisoned PyPI package recommendation, and spread the self-propagating Shai-Hulud worm across roughly 100 internal repositories. Mandiant's derived controls:

• Verify AI-recommended dependencies against cryptographic checksums and approved allowlists.
• Keep API keys and long-lived OAuth tokens out of AI extensions' direct reach.
• Route dependency traffic through controlled internal repositories.

Checksums and allowlists catch both typosquatted packages and hallucinated ones — models sometimes invent package names that attackers can then register in public registries.

Step 4: Put human review between every AI iteration. A controlled experiment found a 37.6% increase in critical vulnerabilities after just five rounds of LLM "improvements" without human review — a phenomenon the authors call feedback loop security degradation. Even security-focused prompts didn't prevent it. The same study's conclusion is the consensus view: human-AI collaboration, not AI autonomy, is the safe model, because developers provide quality control that automated systems cannot replicate.

The same verify-before-trust principle applies to the agent skills and SKILL.md packages many AI coding workflows now load — research has found roughly 26% carry at least one vulnerability. SkillzBench is building a free directory that security-scans, version-pins, and sandbox-benchmarks every listed skill, so you can extend this audit discipline to the tools your agents use, not just the code they write.

Make It Stick: Secure Prompting, Checklists, and Team Guardrails

The biggest obstacle to durable AI code review isn't technical — it's cultural. Many teams hesitate to enforce guardrails because they fear slowing down innovation, as Sarit Tager of Palo Alto Networks has observed. But that fear doesn't match the data: Google DORA's research identified team archetypes that achieve both higher throughput and lower instability, proving that high-velocity, high-quality delivery is an observable reality, not a trade-off.

Making secure review stick starts with the prompt itself. As Endor Labs' Andrew Stiefel puts it, "prompts are now the code design specification" — so security requirements need to be written explicitly into them, not assumed. A model that isn't told about your threat model won't reason about it, since it's rewarded for solving the task, not for securing it.

Then add a mandatory post-generation step. Matt Makai of Digital Ocean recommends prompting the tool itself: "What are the potential security vulnerabilities of this feature? How do I rewrite it?" If you don't ask for the security review, the tool won't do it for you. This single habit catches the omission failures — missing validation, sanitization, and authorization — that AI code is most prone to.

Three practices turn this into a team-wide system:

• Maintain audit trails of prompts, generated code, and security reviews, so every AI contribution is traceable when something breaks.
• Require developers to understand the code they submit. Accepting AI output without reading it erodes code ownership, making flaws harder to spot or fix later.
• Never chain AI "improvements" without human review — a controlled study found a 37.6% increase in critical vulnerabilities after just five unaudited LLM iterations.

That last point matters because the same supply-chain discipline applies beyond code. Research on agent skills found roughly 26% carry at least one vulnerability, which is why SkillzBench is building a free directory that version-pins, security-scans, and sandboxes every skill before you trust it — the same verify-before-trust principle your team should apply to AI-generated code.

Guardrails like these don't slow teams down; they prevent the rework, incident response, and eroded code quality that actually do. The teams shipping fastest are the ones that made review non-negotiable.

Extend the Same Audit Discipline to Your AI Agent Skills

Your coding agent doesn't just consume code — it consumes instructions. Agent skills, the SKILL.md instruction packages that tools like Claude Code, Codex, Cursor, and Gemini CLI load to guide their behavior, are a supply chain most teams have never audited. And the risk profile looks uncomfortably familiar.

Research on AI-generated code found that 45% of AI output contains security flaws, a rate that has stayed flat for two years. Skills carry a parallel exposure: published research found roughly 26% of skills carry at least one vulnerability. The same verify-before-trust discipline you apply to AI code must extend to the instruction packages your agents consume.

The parallels are direct. Just as iterative AI refinement without human review produced a 37.6% increase in critical vulnerabilities in a controlled study, an unaudited skill can quietly reshape how your agent handles secrets, dependencies, and permissions. And as one hijacked AI coding session demonstrated, spreading a poisoned package across roughly 100 repositories, the tooling around your agent can be an attack vector in itself.

Auditing skills by hand is hard because most are pulled from GitHub with no version pinning, no license check, and no security scan. That's the gap SkillzBench is being built to close. Its free, independent directory is designed to apply the same audit checklist you just used on your code:

• Security-scans every skill before it earns a listing, with a 0–100 trust score built from security, quality, license, maintenance, and community signals
• Pins every version to a commit SHA, so the skill you vetted is the skill your agent runs — and upstream changes trigger re-scans and alerts
• Benchmarks each skill in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points separately from ratings
• Ships a free MCP connector, so you toggle skills and tools per agent and your agent only ever sees what you've explicitly chosen

Everything on the platform — the directory, the MCP connector, the benchmarks, and the alerts — will be free, with money never touching scores. As security practitioners put it, the solution isn't to avoid AI tools but to use them responsibly with appropriate security controls.

So finish the job properly: audit your AI-generated code with the checklist above, then audit your agent skills the same way. Join the SkillzBench waitlist to browse, scan, and test vetted skills free when the platform launches.