Why AI Coding Agents Keep Writing Broken Access Control

What it is

The piece centers on one concrete example: an AI-generated "get invoice by ID" endpoint that authenticates, handles the 404 case, and reads cleanly in review, yet lets any logged-in user read any other organization's invoice by changing the ID in the URL — a BOLA/IDOR bug mapped to CWE-639, CWE-862, and CWE-863.

How it works

The fix is one additional condition on the lookup: match the invoice by ID and by the caller's organization — nothing else about the endpoint changes. The three facts needed to know that are absent from the code and prompt entirely: that invoices belong to organizations, that user access is scoped to org membership, and that cross-org reads are never legitimate in this product. The piece stresses these facts can vary by product (some platforms intentionally allow auditors/resellers to read across tenants), so the rule can't be inferred from code shape alone — it lives in the data model and team knowledge.

Two review details the page calls out specifically: a cross-org request should return the same 404 as a missing record (not 403, which would leak existence and enable enumeration), and returning the stored record unmodified often bundles a data-exposure bug alongside the authorization one.

Preconditions / Affected

Applies to any endpoint that accepts an object identifier (ID, filename, key) from a URL or request body — the piece notes this inventory is "usually shorter than teams expect and longer than they hope."

What to do

Five concrete, tool-free steps from the piece:

1. Inventory every endpoint that accepts an object identifier from the request.
2. Write down ownership rules per resource type (what it belongs to, who may read/modify it).
3. Make authorization an explicit PR review question on agent-authored code: "does this endpoint verify the caller is entitled to the object, and against which field?"
4. Add one cross-tenant test per resource type: a valid session from tenant A must get a 404 on tenant B's object.
5. Run deep contextual analysis across the whole codebase on a regular cadence, distinct from real-time agent checks and CI scans — the piece states object-level authorization flaws specifically surface at this third layer, not the first two.

Caveats

The piece itself flags that the claim "AI-generated code has more authorization flaws than human-written code" is mechanistically well-supported but thinly measured — most published AI-code-security studies target injection/XSS/crypto misuse, which have automatable ground truth, not BOLA.