But We Asked the AI for Secure Code

A few weeks ago a long-time client - someone I have worked with for years, now a development manager at a lovely little startup - called to ask my advice about security in their system.

He told me, full of enthusiasm: “We've moved to developing with AI. It's just insane - we write a prompt, we get code, and we build our system five times faster.” I smiled, because I had heard this quite a lot lately.

I asked: “And what about security?”

He said: “Obviously it's fine - the model knows Best Practices better than anyone, right?” (Hint: not always.)

They gave me an example of code the AI had written - a small API that connects to a database and manages users. Within five minutes I had found:

A classic SQL injection, because the parameter went straight into the query.
An endpoint that returned user data with no real authorization check.
A JWT created with no expiration at all.

The manager looked at me and said: “But we asked for 'secure code' in the prompt…”

And here is the simple truth: an AI model does not understand security. It does not know what is genuinely dangerous in your system. It knows how to imitate code that looks correct from the outside - not how to think like an attacker.

AI is an incredible tool. It accelerates development, it raises ideas, it closes off annoying corners. But secure code still requires people who live security - people who know which questions to ask, and who can see what the ordinary eye misses.

The moral: if you hand the AI all of your development with no human eye that understands secure coding, you are not developing faster. You are just developing your vulnerabilities faster.

I first shared a version of this as a LinkedIn post on 2025-08-11. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula

Keep reading