What 434 AI-Generated Vulnerabilities Reveal About Secure Software Development

## Executive summary A study from Xint.io analyzed 28 AI-generated applications and validated 434 vulnerabilities, finding that missing operational controls (rate limiting, unbounded pagination, blocking operations) and hardcoded secrets are the dominant risks; injection flaws were less common. The report shows that smaller greenfield apps mainly suffer operational-resilience issues while larger, more complex apps exhibit more authorization and IDOR failures, and recommends shifting security reviews toward rate limiting, secret detection, fine-grained authorization testing, runtime load testing, and CI/CD-integrated checks.