AI-Generated Code Shipped Controls but Skipped the Check
Sygnia discovered AI-generated code that managed tokens, expiry, rate limiting, and audit logs, then granted access to anyone with an identifier.
The Issue
A penetration test on a financial services firm revealed a critical vulnerability in AI-generated code designed for customer onboarding. While the code excelled at handling unique identifiers, payment details, and sensitive data, it failed to properly verify user control over these identifiers.
The Flaw
The application granted access tokens based on an applicant’s GUID (globally unique identifier), assuming that possessing the GUID proved identity. However, this meant that anyone with another applicant’s GUID could access personal information, including names, contact details, financial records, and co-applicant data.
The Controls
Notably, the implementation included several security controls: temporary tokens, expiration, rate limiting, audit logging, session restoration, and suspicious activity detection. What it lacked was a proper trust decision mechanism before token issuance.
Architectural Flaw
The vulnerability wasn’t due to insecure coding practices or data flows but an architectural assumption about trust. The code, while following familiar framework conventions and passing basic checks, failed to address the core issue of verifying user control over sensitive data.
"Working code is not the same as secure code." – Zach Mead, Sygnia penetration tester.