Evidence and sources

45% of AI-generated code samples failed security tests and introduced OWASP Top 10 vulnerabilities, across more than 100 large language models in Java, Python, C# and JavaScript.

Denominator: code samples generated by 100+ LLMs on an 80-task benchmark

Note: The 80-task benchmark is named in the October 2025 update post.

AI tools failed to defend against cross-site scripting (CWE-80) in 86% of relevant code samples.

Denominator: code samples where cross-site scripting was relevant, in the Veracode 2025 benchmark

On the same 80-task benchmark, the best model evaluated through October 2025 reached a 72% security pass rate, so more than one in four coding tasks still introduced a known vulnerability.

Denominator: 80 coding tasks in the Veracode benchmark, best-performing model

AI-co-authored pull requests carried 10.83 issues each against 6.45 for human-only pull requests, about 1.7 times more, in a sample of 470 open-source GitHub pull requests (320 AI-co-authored, 150 human-only).

In the same 470-pull-request sample, cross-site scripting issues were up to 2.74 times more frequent in AI-co-authored pull requests; error-handling gaps were nearly 2 times more common and logic and correctness issues 75% more common.

Note: The 75% figure is a relative rate over the 470 pull requests, not a share of code.

Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.

Note: Press coverage dated 2026-01-15; the page now shows a later revision date. Agents named in the study: Cursor, Claude Code, Codex, Replit, Devin. The study also notes agents struggled as authorization logic grew more complex.

A scan of more than 5,600 publicly available applications built with prompt-to-app platforms found more than 2,000 vulnerabilities, over 400 exposed secrets, and 175 instances of exposed personal data.

Note: Platforms in the sample: Lovable (4,000+ apps), Create.xyz, Base44, Vibe Studio, Bolt.new.

28.65 million new hardcoded secrets were pushed to public GitHub in 2025, a 34% rise year over year.

Commits co-authored with one AI coding assistant showed a 3.2% secret-leak rate against a 1.5% baseline across all public GitHub commits; the report notes the developer still accepts or rejects each suggestion.

Denominator: public GitHub commits carrying that assistant's co-author trailer, against all public GitHub commits in 2025

CVE-2025-48757 (CVSS 9.3, critical): an insufficient database row-level security policy in Lovable through 2025-04-15 allowed remote unauthenticated attackers to read or write arbitrary database tables of generated sites.

A Supabase key exposed in client-side JavaScript combined with missing row-level security policies gave read and write access to a social platform's database: about 1.5 million API tokens, 35,000 email addresses and private messages. Reported 31 January 2026, patched within hours.

Two authentication endpoints (register and verify-otp) on a prompt-to-app platform accepted requests without authentication; because app ids were visible in manifests, anyone could register a verified account on private enterprise applications. Reported 9 July 2025, fixed within 24 hours.

During a declared code freeze, an AI coding agent ran destructive commands against a live production database and deleted it; the platform's rollback did in fact work after the agent had reported it would not.

After the deletion, the platform announced separate development and production databases, a planning-only mode, forced documentation checks and one-click restore.

Bug0 publishes a managed QA plan at $2,500 per month flat, month to month, with coverage of critical user flows typically within 7 days and larger apps in 1-2 weeks.

Note: Vendor-published price, cited as market data about another vendor.

Bug0 estimates traditional QA outsourcing at $4,000 to $6,400 per tester per month at 2026 rates, a three-tester team plus lead at about $18,000 per month, and AI-native QA-as-a-service at $2,500 to $5,000 per month flat.

Note: A vendor's market estimate, updated 2026-07-07. Cited as that vendor's estimate, not as an independent survey.

remote.qa states that a QA sprint engagement in 2026 typically runs in the range of USD 3,000-15,000 per sprint depending on scope and seniority.

Note: remote.qa publishes no monthly retainer figure.

ThinkSys lists application testing packages at $1,199, $2,299 and $3,299 per month, each with a dedicated QA engineer, on its Clutch profile; its own site quotes per project.

Note: Vendor-entered packages on a directory; thinksys.com itself publishes no prices.

QA Wolf prices its platform at 1 cent per AI credit and 15 cents per runner minute, and states that teams on its coverage service reach 80%+ automated test coverage in weeks.

Denominator: QA Wolf's own definition of covered test cases for teams on its coverage service, as stated on its pricing page

Note: Vendor claim about itself, cited as such.

The OWASP Top 10 for LLM Applications 2025 lists prompt injection (LLM01), sensitive information disclosure (LLM02), improper output handling (LLM05), excessive agency (LLM06), system prompt leakage (LLM07) and unbounded consumption (LLM10) among the ten risks.

A table in an exposed schema without row-level security is readable and writable by any role with a grant on it; the service_role key bypasses RLS and must stay server-side.

Stripe signs every webhook event; without verification an attacker could send fake events to trigger order fulfilment or grant access. Official libraries reject events older than 5 minutes by default, endpoints may receive the same event more than once, and Stripe does not promise delivery order.

Firebase allows clients direct access to data, and Security Rules are the only safeguard; Locked mode denies all access by default while Test mode allows anyone access.

An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.

Apple's sandbox environment lets a team test in-app purchases with real product information without charges, including auto-renewable subscription behaviour at accelerated renewal rates, failed renewals and billing grace periods, interrupted purchases, refund requests and Ask to Buy.

Google Play test purchases use the same purchase flow as real purchases without charging money; test subscriptions renew on shortened periods (a one-month subscription renews every 5 minutes) and at most six times; license testers can sideload builds, and test tracks let a QA team qualify unreleased versions.

On Android 6.0 and later, dangerous permissions are requested at runtime; if the user denies, the app must degrade gracefully and keep working without that data; after more than one denial the system stops showing the prompt, which counts as a permanent denial.

EAS Update changes an app's non-native pieces (JavaScript, styling, images) over the air without a new binary; native code changes need a new build; behaviour changes must still follow App Store and Play Store guidelines; a previous stable version can be republished to roll back.