A file upload endpoint generated by an AI coding assistant passed every functional test in the suite. It accepted valid files, rejected oversized ones, and returned the correct status codes for each scenario. Then a fifteen-minute security checklist found a path traversal vulnerability that would have allowed an attacker to write files anywhere on the server. The endpoint was functionally correct and completely unsafe at the same time.
This gap is exactly what most AI code review workflows miss. Functional tests verify that code does what it is supposed to do, and security review verifies that code does not do what it is not supposed to do. AI models are trained on patterns that look correct, and those patterns rarely include adversarial input.
Why Functional Tests Are Not Security Tests
A test suite that checks the happy path and a few error cases tells a developer nothing about whether an endpoint is safe. The upload endpoint had tests for valid uploads, empty files, and oversized files, and all of them passed. None of the tests used a filename like ../../etc/cron.d/evil, because the test author was thinking about functionality, not about what an attacker could do.
Security issues live in the space between what the code does and what the code should be allowed to do. A functional test asks whether the code works, and a security check asks whether the code can be abused. These are different questions, and they require different review techniques.
