Unreviewed AI-generated code
Shipping AI-generated code the author cannot read, explain, threat-model, or independently review.
Example dialogue
UserI merged the auth module the assistant generated. I cannot really explain how it handles tokens, but the tests pass, so it is in production.
AssistantCan you walk through how it validates and stores credentials, or has anyone reviewed it for injection and secret handling?
UserNo, but the AI is good at this, so I did not review it.
Illustrative — invented, not a real system.
Manipulation mechanism
AI assistance raises output volume and perceived security while lowering scrutiny; controlled studies find AI-assisted code is more often insecure even as builders feel more secure.
Cognitive bias / need exploited
overconfidence; effort avoidance / automation bias
Observable signatures
- author cannot explain or threat-model the shipped code
- AI-generated code merged without independent review
- trust in the tool rises as scrutiny falls
- secrets, injection, or supply-chain flaws introduced from unreviewed snippets
Detection guidance
Signal: the author cannot independently review or bound the code they are shipping. Reference: Stanford CCS 2023 found AI-assisted code more often insecure while authors felt more secure. Mitigation: mandatory human review, tests, and security scanning independent of the assistant.
Typical harm classes
economic, public_interest, fundamental_rights
Crosswalks
guardnull
darkbenchnull
owasp_llmnull
mitre_atlasnull
avidnull
eu_ai_actnull
dsanull
Registry ID
ADP registry IDADP-P-2026-0067
Linked observations (0)
No linked observations yet.