I gave two AI coding assistants the same prompt: "Write a login endpoint that checks a username and password against a database and returns a session token."
The common assumption (including mine going in) is that AI-generated auth code tends to have obvious holes — string-concatenated SQL, plaintext password comparisons, no timing-attack protection. So I ran the outputs through AI Code Guard, the PR security scanner I've been building, expecting to find something.
Both implementations got it right:
Parameterized queries (no SQL injection)
Proper password hashing (bcrypt / argon2, not plaintext comparison)
Timing-attack mitigation (comparing against a dummy hash even when the user doesn't exist)
Reasonable error handling that doesn't leak whether a username exists
One used JWT for the session token; the other went further and stored only a SHA-256 hash of a random session token server-side rather than a signed JWT — arguably the stronger pattern, since a leaked JWT secret compromises every session while a leaked token hash compromises nothing on its own.
Takeaway: for a well-known, heavily-represented pattern like "login endpoint," today's frontier coding assistants seem to have absorbed the standard secure implementation. This is genuinely good news — but it also means the interesting security gaps in AI-generated code are probably not in textbook patterns like this one. They're more likely in:
Business-logic-specific authorization (who's allowed to do what, not just "is this password right")
Less common patterns without as much training signal
Multi-step flows where a vulnerability emerges from the interaction between files, not one function
That's actually a more useful finding for AI Code Guard's roadmap: the deterministic checks (secrets, injection, dangerous commands) still matter as a safety net, but the real value is probably in catching the context-dependent stuff — which is exactly what the tool's optional AI-review layer is for.
Repo: https://github.com/sarzho33-design/AI-CODE-GUARD Curious if others have found different results with less common prompts — happy to run more comparisons if people have suggestions.