Yep. Unless you inspect the payload and actual code / validation logic, there is nothing to distinguish an API that "works" and is totally insecure from one that is actually secure. I've seen Claude Code generate insecure APIs that "worked", only to find decided to add a user ID as a parameter and totally ignore any API token.
Re:How I write software with LLMs
by raw_anon_1111 on Monday March 16, 2026 @11:07AM
(#47400020)
And you haven’t seen security vulnerabilities in the wild based on careless human generated code?
Except security researchers. I work in cybersecurity and we already see vulnerabilities caused by careless AI generated code in the wild. And this will only get worse (or better for my job security).