AI code's security bugs are rarely bad code -- they're missing code
RyzeBlaziken · reddit · 2026-09-17
A developer reviewing AI-generated PRs for a security tool identifies a failure mode: LLMs write what you asked well, but often skip implicit security checks nobody explicitly requested. Real examples: a calendar API endpoint with no ownership check on IDs, and a signing page returning a recipient's PII before verifying authorization. In both cases the existing code was ordinary -- the vulnerability is a branch never written. The author asks whether others see the same omission-vs-commission split and whether research exists on surfacing implicit requirements.
More from coding & agent
- Typesafe AI Launches Jev: A Decision Engine at 70-500ms and $0.042 Per Million Tokens — brandon_galang · 2026-09-17
- Open-source Helicon app brings Meta's Muse Code CLI to Windows desktop — alexandr_wang · 2026-09-17
- Netlify to livestream a Grok Bot autonomously building and deploying a site — thisiskp_ · 2026-09-17
- OpenJev open-sources Jev-style semantic decisions on a single RTX 3090 with a frozen 4B model — alexcovo_eth · 2026-09-17
- Browser Use CEO on agentic engineering: humans are the bottleneck, he stopped reading code — David Ondrej · 2026-09-17
- Jev: an open-source action-picker that splits agent thinking from clicking — alexcovo_eth · 2026-09-17