I scanned 115 files from 41 AI-built projects — here’s what the scanner flagged.

Code that looks ready to ship still deserves a security review.

In this ongoing study, 42% of scanned files had at least one critical finding.
Critical alerts included:

• 28 vulnerable-dependency findings
• 12 broken-access-control findings
• 7 sensitive-data-exposure findings
• 7 XSS / HTML-injection findings
• 5 prompt-injection findings
• 3 missing-authentication findings
• 3 open-CORS findings

These are finding counts—not counts of affected projects. They’re also scanner alerts, not manually confirmed exploits.

Across all severity levels, missing state handling and code quality each produced 53 findings. Security wasn’t the only concern; handling failures and unexpected states mattered too.

This is an incomplete scan of selected public repositories, so the results shouldn’t be generalized to all AI-generated code.

My takeaway: generate → scan → review → fix → test.

What do you verify manually before shipping an AI-built app?