7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them)

7 Vulnerability Patterns I Found in AI-Generated Code (and How to Catch Them) If you've used GitHub Copilot, Claude Code, or any AI coding assistant for more than a few weeks, you've probably shipped at least one of the bugs in this post without realizing it. Not because the AI is bad at coding — these tools are remarkably good — but because certain classes of mistake show up disproportionately in AI-generated code, for reasons that have nothing to do with capability and everything to do with what a code sample optimizes for. I wanted to find out whether that pattern was real or just a feeling, so I built ai-vuln-scan, a static analysis tool tuned specifically to these patterns, and used it to look closely at what actually goes wrong. Here's what I found, and the open-source tool that came out of it. The core idea: AI-generated bugs aren't random Traditional static analysis tools look for bugs in general. What I was after was narrower: which specific mistake