AI coding assistants are everywhere. Cursor, Copilot, Lovable, and Bolt are transforming how we write code. Developers who could not build a full-stack app three years ago are shipping products in days.
But there is a cost. A hidden one.
AI learned from public repositories. And public repositories are full of security mistakes. The AI does not know that an API key should be in an environment variable. It does not know that CORS should not be set to *. It does not know that a dependency should be pinned.
It writes what you ask for. It does not write what you need for security.
Here is what we found scanning AI-generated code with 9 security engines.
