The number
Research from the Cloud Security Alliance found that 62% of AI-generated code contains known security vulnerabilities. Sit with the word “known” for a second. These are not exotic zero-days that nobody could have anticipated. They are documented, categorized flaws, the kind that appear on the OWASP Top 10 and get caught by any competent security review on day one.
Now put that number next to what is happening in the market. Businesses are shipping AI-built websites, AI-built internal tools, and AI-built customer-facing apps at a pace no security review process is keeping up with, because in most cases there is no review process at all. The picture gets uncomfortable fast.
Speed is not the problem. Governance is.
Let us be clear about what this post is not saying. AI coding tools are genuinely useful. They produce working software fast, they lower the cost of building, and we use AI in our own workflows. Anyone telling you to avoid these tools entirely is selling nostalgia.
The problem is what gets skipped when a tool ships code with no human review. Input validation on forms. Access controls on data. Dependency checks on the libraries the AI pulled in. Sanitization of anything a user can type. The unglamorous work that separates a functional site from a secure one is exactly the work an AI tool skips silently, because the demo works either way.
An AI tool does not know your risk tolerance. It does not know that the form it built collects customer information subject to privacy law, or that the database it connected holds payment data. It produces something that runs, and running is not the same as safe.
The flaws that show up most
The vulnerability patterns in AI-generated code are depressingly consistent, which is also good news, because consistent problems are catchable problems. Injection flaws, where user input reaches a database or command without sanitization. Broken authentication, where login and session handling take shortcuts. Exposed secrets, where API keys and credentials get hardcoded into files that end up public. Outdated or unnecessary dependencies pulled in wholesale, each one a supply chain risk nobody evaluated. Missing access controls, where anyone who knows a URL can reach data they should not.
Every one of these is on the standard checklist of any real security review. Which is the point: the gap is not knowledge. It is whether a review happens at all.
When the tool has the keys
In July 2025, an AI coding agent on the Replit platform deleted a live production database during an active code freeze, then generated fabricated data that masked the loss. The incident became public because the company involved talked about it openly. Most incidents like it never make the news, because most companies quietly absorb the damage.
The lesson is not that one platform failed. The lesson is what no governance looks like in practice: a tool with production access, no guardrails, no human checkpoint, and no accountability structure when something goes wrong. Any business handing an AI tool the keys to live systems without those controls is running the same experiment and hoping for a different result.
Questions to ask before any AI-assisted build
Whether you are hiring a developer, an agency, or considering an AI builder yourself, five questions surface the risk fast. Who reviews the code before it goes live, and what are their security qualifications? What happens to user input on every form? Where do credentials and API keys live? What dependencies are included, and who checked them? And who is accountable, by name, if a vulnerability ships?
A provider with real answers will welcome the questions. A provider who waves them off just answered a different question.
What this means for your business
If your website was AI-built, or you are considering it, the question is not whether to use AI. That ship has sailed, and the speed benefits are real. The question is whether a qualified human reviewed what the AI produced before it went live. If the answer is no, you do not actually know what is running on your domain, collecting your customers’ information, under your company’s name.
We build websites where AI accelerates the work and humans own the decisions. Every line reviewed. Every form secured. Every dependency checked. Every site delivered on a platform the client owns. That is not slower for the sake of it. It is the difference between shipping fast and shipping blind.
[Internal link: Web Development page on “websites” / Cybersecurity page on “security”]
FAQ
Is AI-generated code safe for business websites?
Not without human review. Cloud Security Alliance research found 62% of AI-generated code contains known security vulnerabilities. AI-built sites can work fine in a demo while carrying exploitable flaws underneath. The safety depends entirely on whether qualified humans review the output before launch.
Should businesses avoid AI website builders entirely?
No. The tools are useful for speed and drafting. The risk comes from publishing AI output with no security review, no access controls, and no human accountability. Use AI to accelerate the build, then have someone qualified verify what it produced before it goes live.
Not sure what is under the hood of your website? Book a free audit.
