AI Code Vulnerabilities: Resource Exhaustion & Secret Exposure

AI coding agents can introduce new types of vulnerabilities into applications. Theori built 28 apps using AI and found that common security bugs like SQL injection were rare. Instead, the most frequent flaws were resource exhaustion and denial-of-service issues, appearing in 21% of findings. These problems often stem from unbounded pagination or a lack of rate limits. Secrets exposure accounted for nearly half of the critical vulnerabilities, including hardcoded keys. Access-control bugs also increased with app size. For example, a rewritten content management system showed 28% access control flaws, compared to 11% in smaller builds. The team confirmed 434 unique vulnerabilities out of 8,827 initial detections. Automated review tools are now seen as essential for managing the volume of AI-generated code. This means that human expertise is shifting to high-level threat modeling and architecture review.