AI-Generated Code Averages 15 Security Vulnerabilities Per Codebase, Study Finds

My take: The Aeris Research study moves the conversation about AI-generated code from perception to hard evidence. Across 1,760 projects and 16 models, it found an average of 15 security vulnerabilities per codebase. Forty percent of AI-generated code snippets contain critical flaws. And privilege escalation paths (one of the most exploited attack vectors) increased 322% in projects with high AI-generated code dependency.

The pattern is straightforward: models generate code that matches what the prompt describes, not the most secure version possible. If the instruction does not specify security controls, the model does not add them by default. The responsibility still falls on the developer who reviews and approves.

For any team using AI to write code, the practical question is not whether to use AI, but whether the code review process is designed to catch the specific vulnerabilities models introduce most often: privilege escalation, SQL injection, XSS. Has your review workflow evolved alongside your AI tools?