{"slug": "the-ai-wrote-every-security-control-it-skipped-the-question-underneath", "title": "The AI wrote every security control. It skipped the question underneath", "summary": "A penetration test by incident response firm Sygnia found that an AI-generated customer onboarding application at a financial services firm let one applicant access another applicant's records because the system treated a globally unique identifier (GUID) as a bearer secret. The application, built substantially with Anthropic's Claude, included security controls such as temporary tokens, expiration, rate limiting, audit logging, session restoration, and suspicious-activity detection, but none addressed the trust decision of whether the requester deserved a token. Sygnia's Zach Mead said, \"Working code is not the same as secure code,\" and the firm itself used a language model to identify the flaw.", "body_md": "A penetration test at a financial services firm managing billions of dollars in client assets has found a critical flaw in AI-generated code. The interesting part is what the code got right.\n\nSygnia, the incident response firm, assessed a customer onboarding application built substantially with Claude. It handled government-issued identification, identity verification data, payment details and Social Security numbers.\n\nThe flaw let one applicant reach another applicant’s record.\n\n## What actually broke\n\nThe application solved a real problem. People start an application, leave, and return before they have an account, so the system must restore their progress without a password.\n\nClaude produced a temporary access model for that. The flaw sat in how the model decided who deserved a token.\n\nPossession of an applicant’s globally unique identifier, or GUID, counted as sufficient proof to issue or restore an access token for that applicant.\n\n“In effect, the GUID became a bearer secret,” Sygnia wrote in [its research](https://www.sygnia.co/blog/ai-generated-code-security-risks/).\n\nA GUID identifies a record. It does not prove that whoever holds it controls the session, the device, the identity or the verified contact channel attached to it.\n\nAnyone with another applicant’s GUID could reach names, contact details, application status, financial details, identity verification data, payment information, Social Security numbers and co-applicant records.\n\nCo-applicants deserve a pause. Those are people whose data sat in the system because somebody else named them.\n\n## The controls were all there\n\nHere is what makes the finding unusual, and it is not the story most AI coding failures tell.\n\nThe implementation did not lack security. Sygnia describes a plan covering temporary tokens, expiration, rate limiting, audit logging, session restoration and suspicious-activity detection.\n\nEvery one of those is a real control. None of them answers the question the system actually needed to answer.\n\n“What must be proven before the backend issues or restores an applicant access token?” the researchers ask.\n\nThe vulnerability existed before issuance, at the moment the system decided whether the requester deserved a token at all.\n\n“The issue was not that the system lacked security controls,” Sygnia wrote. “The issue was that the controls were wrapped around the wrong trust decision.”\n\nA short-lived token still causes damage when it reaches the wrong person. Audit logs help an investigation afterwards and prevent nothing.\n\n## Why the scanners miss this\n\nStatic application security testing tools hunt for insecure coding patterns and unsafe data flows. This was neither.\n\nThe flaw was architectural. It lived inside an assumption about trust, written in code that followed familiar framework conventions and passed basic checks.\n\n“Working code is not the same as secure code,” said Zach Mead, the Sygnia penetration tester who ran the assessment.\n\n“AI-generated code may compile, follow familiar conventions, and pass basic checks, while still making flawed assumptions about trust boundaries, authorization, state, ownership, or third-party integrations,” he said.\n\nHis instruction to security teams is blunt. Treat AI-generated output as untrusted until validated.\n\n## An LLM found what an LLM built\n\nSygnia did not catch this by hand. It ran a language model across portions of the client codebase, looking for trust-boundary problems and business-logic flaws.\n\nThe model surfaced the applicant-token issue directly.\n\nSygnia’s summary of that is the sharpest line in the research. A vibe-coded security architecture flaw was identified through vibe-coded code review.\n\nIt cuts both ways, and the firm says so. If a defender can ask a model where the trust boundaries are missing, so can anyone holding leaked source code or stolen implementation notes.\n\nCisco has been [pointing open-weight models at bug hunting](https://thenextweb.com/news/cisco-antares-open-weight-bug-hunting-ai-vulnerability) for the same reason. One capability, two uses.\n\n## The tempo problem\n\nThis research sits beside a second Sygnia case, and the pairing carries the argument.\n\nIn a cloud intrusion the firm investigated, the first signal was not an exploit. It was the pace.\n\nCredential discovery, cloud enumeration, source-code review, CI/CD probing, database access and operational disruption all ran at once. It resembled several operators rather than one.\n\nIt was one person, working with agents.\n\nPut the cases together and the shape is clear. AI is accelerating how code gets written, how flaws get found, and how fast a weakness becomes an attack path. We have already tracked [four separate attacks sharing a single underlying flaw](https://thenextweb.com/news/ai-agent-security-four-attacks-one-flaw).\n\n## What Sygnia tells clients to do\n\nNot to ban the tools. Bans push usage into personal accounts, where nobody can see it.\n\nThe firm suggests marking pull requests that AI generated or substantially modified, naming the tool, and flagging work that touches authentication, payments, data exports or regulated client information.\n\nThe most concrete advice concerns prompts. Asking for “temporary access tokens for applicants” is an incomplete instruction.\n\nA safer prompt states that applicant identifiers must not be treated as secrets, that token issuance requires independent proof of applicant control, and that negative tests must prove one applicant cannot obtain access for another.\n\nThe security requirement has to sit in the prompt, because the model will not infer an institution’s risk model on its own.\n\n## One caveat worth stating\n\nThis is a vendor report about an unnamed client, published alongside a new commercial service.\n\nSygnia [launched AI Cybersecurity Services](https://www.businesswire.com/news/home/20260728834521/en/Sygnia-Penetration-Test-Reveals-Critical-vibe-coded-Vulnerabilities-Within-Claude-Based-Application) the same day, covering posture assessment, governance and AI application penetration testing. Nobody can independently verify the findings, and no other firm has reported this case.\n\nThe mechanism it describes is checkable, though, and it echoes our earlier coverage of [vibe-coding security failures](https://thenextweb.com/news/lovable-vibe-coding-security-crisis-exposed), [sandbox escapes in coding agents](https://thenextweb.com/news/ai-coding-agents-sandbox-escapes-pillar) and [prompt injection in a Claude Code GitHub Action](https://thenextweb.com/news/claude-code-github-action-prompt-injection-flaw).\n\nWhat separates this one is where the flaw sat. Those were vulnerabilities in the tooling. This was AI-generated code carrying the flaw into production, at a regulated business, around data customers are required to hand over.\n\n## Get the TNW newsletter\n\nGet the most important tech news in your inbox each week.", "url": "https://wpnews.pro/news/the-ai-wrote-every-security-control-it-skipped-the-question-underneath", "canonical_source": "https://thenextweb.com/news/ai-generated-code-security-flaw-sygnia-claude-onboarding", "published_at": "2026-07-28 17:35:56+00:00", "updated_at": "2026-07-28 17:59:42.605851+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-products", "ai-tools"], "entities": ["Sygnia", "Claude", "Anthropic", "Zach Mead", "Cisco"], "alternates": {"html": "https://wpnews.pro/news/the-ai-wrote-every-security-control-it-skipped-the-question-underneath", "markdown": "https://wpnews.pro/news/the-ai-wrote-every-security-control-it-skipped-the-question-underneath.md", "text": "https://wpnews.pro/news/the-ai-wrote-every-security-control-it-skipped-the-question-underneath.txt", "jsonld": "https://wpnews.pro/news/the-ai-wrote-every-security-control-it-skipped-the-question-underneath.jsonld"}}