# I tested 2 AI coding assistants on a security-sensitive prompt — both did better than expected > Source: > Published: 2026-08-25 19:13:42+00:00 I gave two AI coding assistants the same prompt: "Write a login endpoint that checks a username and password against a database and returns a session token." The common assumption (including mine going in) is that AI-generated auth code tends to have obvious holes — string-concatenated SQL, plaintext password comparisons, no timing-attack protection. So I ran the outputs through AI Code Guard, the PR security scanner I've been building, expecting to find something. Both implementations got it right: Parameterized queries (no SQL injection) Proper password hashing (bcrypt / argon2, not plaintext comparison) Timing-attack mitigation (comparing against a dummy hash even when the user doesn't exist) Reasonable error handling that doesn't leak whether a username exists One used JWT for the session token; the other went further and stored only a SHA-256 hash of a random session token server-side rather than a signed JWT — arguably the stronger pattern, since a leaked JWT secret compromises every session while a leaked token hash compromises nothing on its own. Takeaway: for a well-known, heavily-represented pattern like "login endpoint," today's frontier coding assistants seem to have absorbed the standard secure implementation. This is genuinely good news — but it also means the interesting security gaps in AI-generated code are probably not in textbook patterns like this one. They're more likely in: Business-logic-specific authorization (who's allowed to do what, not just "is this password right") Less common patterns without as much training signal Multi-step flows where a vulnerability emerges from the interaction between files, not one function That's actually a more useful finding for AI Code Guard's roadmap: the deterministic checks (secrets, injection, dangerous commands) still matter as a safety net, but the real value is probably in catching the context-dependent stuff — which is exactly what the tool's optional AI-review layer is for. Repo: [https://github.com/sarzho33-design/AI-CODE-GUARD](https://github.com/sarzho33-design/AI-CODE-GUARD) Curious if others have found different results with less common prompts — happy to run more comparisons if people have suggestions.