Phase 5: Security Testing AI-Generated Code · 50 min · Python · Bandit · Semgrep

CWE Patterns in AI Code

AI doesn't write random bugs. It writes the same CWEs every time.

Hiring signal: Engineers who can identify AI-concentrated CWE patterns (CWE-1236, CWE-916, CWE-20, CWE-117) demonstrate the ability to target security testing at AI-specific defect categories.

What you will learn

Identify CWE-1236 (incorrect escaping) at 50.7% AI file rate and why AI systematically introduces it
Identify CWE-916 (broken crypto) at 43.1% and why AI gets crypto wrong
Identify CWE-20 (input validation) and CWE-117 (improper logging) patterns in AI code
Understand the 86.8% network attack surface finding and its implications

The Problem

The Z3 study revealed that AI-generated code doesn't have random vulnerabilities -- it has systematic, concentrated CWE patterns. Certain CWE categories appear in AI code at rates far higher than in human code. Understanding these patterns lets you target your security testing at the exact defect categories AI is most likely to introduce.

AI-Concentrated CWE Patterns

CWE ID	Name	AI File Rate	Human Code Rate	AI/Human Ratio
CWE-1236	Incorrect Escaping	50.7%	8.2%	6.2x
CWE-916	Broken Crypto	43.1%	5.7%	7.6x
CWE-20	Input Validation	38.4%	12.1%	3.2x
CWE-117	Improper Logging	29.6%	6.3%	4.7x

AI code has 3-8x higher rates of these CWEs compared to human code. This isn't random -- it's systematic.

CWE-1236: Incorrect Escaping (50.7% of AI files)

AI systematically gets escaping wrong. It either:

Under-escapes: doesn't escape special characters at all
Over-escapes: double-escapes (e.g., &lt; instead of <)
Wrong context: uses HTML escaping in SQL context or vice versa

# AI-generated (vulnerable): only escapes <, misses > and " and '
def escape_html(text):
    return text.replace("<", "&lt;")

# Correct: escapes all HTML special characters
def escape_html_correct(text):
    return (text.replace("&", "&amp;")
            .replace("<", "&lt;")
            .replace(">", "&gt;")
            .replace('"', "&quot;")
            .replace("'", "&#x27;"))

CWE-916: Broken Crypto (43.1% of AI files)

AI gets cryptography wrong in three ways:

Weak algorithms: uses MD5, SHA1, DES instead of SHA-256, AES
Hardcoded keys: embeds encryption keys directly in source code
Wrong mode: uses ECB mode instead of CBC/GCM

# AI-generated (vulnerable): uses MD5 and hardcoded key
import hashlib
API_KEY = "hardcoded_secret_123"

def hash_password(password):
    return hashlib.md5(password.encode()).hexdigest()

# Correct: uses SHA-256 with salt
import hashlib, os

def hash_password_correct(password, salt=None):
    if salt is None:
        salt = os.urandom(32)
    return hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000)

CWE-20: Input Validation (38.4% of AI files)

AI doesn't validate inputs. It trusts user input without checking type, range, or format.

CWE-117: Improper Logging (29.6% of AI files)

AI logs sensitive information (passwords, tokens, PII) or injects user input into log messages without sanitization.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The 86.8% Network Attack Surface, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.