Skip to content

Back to the catalog

The Most Common Security Vulnerabilities in AI-Generated Code | Blog | Endor Labs
endorlabs.comarticle

The Most Common Security Vulnerabilities in AI-Generated Code | Blog | Endor Labs

Endor Labs blog post analyzing why LLM-generated code (from tools like GitHub Copilot, Cursor, Replit Ghostwriter) reproduces classic vulnerability patterns from its open-source training data, citing recurring CWE Top 25 weaknesses such as missing input validation (CWE-20), SQL/OS command injection (CWE-89/CWE-78), broken authentication/access control (CWE-306/CWE-284), and hard-coded credentials (CWE-798). It also covers AI-specific risks: dependency explosion from oversized auto-generated dependency trees, stale/vulnerable library suggestions past training cutoff, hallucinated package names enabling slopsquatting attacks, and "architectural drift" where AI edits silently break security invariants without triggering static analysis or code review flags.

TL;DR Endor Labs catalogs the CWE-mapped vulnerability patterns and AI-native risks (hallucinated deps, dependency explosion, architectural drift) common in LLM-generated code.
Open original ↗

Organisations named here

  • CWE-20
  • CWE-284
  • CWE-78
  • CWE-89
  • slopsquatting

Technologies named here

  • GitHub Copilot
  • Cursor
  • Replit's Ghostwriter
  • Endor Labs
  • Missing Authentication for Critical Functionality

Techniques named here

  • Missing input validation
  • SQL injection
  • OS Command Injection
  • Broken authentication
  • Broken access control
  • Hardcoded credentials
  • Dependency explosion / stale libraries
  • Hallucinated dependencies / slopsquatting
  • Architectural drift
  • Use of Hard-coded Credentials

Related in AI Security