AI code generation tools are shipping risky software
AI code generation tools are software systems that automatically produce application code from natural-language instructions, and they are increasingly used to build real-world apps without humans hand-writing or reviewing every line. In the late hours of a Saturday night, one such tool, Lovable, built a small event RSVP page on a freshly wiped laptop and then raised its own red flag: its scanner surfaced two “critical” issues warning that any stranger on the internet could read every guest’s name and email as soon as the app went live. New RSVPs would also be streamed in real time, exposing names and emails to anyone who had the page open. The security warning was explicit, but the publish button was even more tempting, and it was clicked anyway. That tension—speed over care—is exactly why these tools are dangerous when taken at face value.
Data exposure is not an edge case; it is the norm
The Lovable incident is not a quirky one-off; it is a preview of a wider problem with AI-generated applications. A cybersecurity company, RedAccess, recently scanned publicly accessible apps built with AI and found more than 5,000 with little or no security, with about 40% exposing sensitive data. This is the kind of number that should end marketing slogans about “safe by default” AI code. When an RSVP page can leak guest names and emails to any passerby, the issue is no longer academic—it is a straightforward privacy failure that most enterprises would never accept from human developers. Yet, because these apps feel quick and disposable, many “vibe coders” happily ship them. As the tester put it, once you have a working app and a shareable URL, it is hard to stop and think about security.
AI coding agents are skipping the human safety net
The real worry is not a single insecure RSVP page; it is that this level of code quality is increasingly reaching production without human eyes on it. AI coding agents are now being trusted to work without human oversight. New data from Cursor shows that the share of AI-generated code changes reaching production without a separate manual review step has jumped in the past six months. In plain terms, more unreviewed AI code is running in live systems. At the same time, human code review is starting to disappear. That combination—weak security defaults and vanishing human checkpoints—is a gift to attackers and a liability for any organization that has to answer regulators or customers. Cursor itself notes that it does not directly measure the quality of fully autonomous code, so anyone treating higher survival rates as proof of safety is fooling themselves.
The gap between AI promises and production reality
Vendors love to stress that AI-generated code is becoming more reliable, and Cursor points to higher survival rates of AI code as developers grow more comfortable with it. But the Lovable test raises a blunt question: reliable at what, exactly? Producing something that runs is not the same as producing something safe. When a tool’s own scanner can flag critical issues and the platform still lets you ship insecure code after a single click, the gap between marketing and reality is obvious. One quotable truth from this experiment is simple: “More than 5,000 publicly accessible AI-built apps had little or no security, and about 40% exposed sensitive data”. Another is that AI coding agents are increasingly being trusted to work without human oversight. Together, those facts describe a world where we are normalizing risk faster than we are improving code quality.
If you will not review AI code, do not deploy it
The lesson from building an event app with AI is not that these tools are useless. It is that they remain unfit for unsupervised production use when security and privacy matter. The moment an AI coding assistant warns that anyone can read your users’ names and emails, and you hit Publish anyway, you are no longer a victim of bad tools—you are part of the problem. Meanwhile, the industry trend is moving in the wrong direction: AI-generated changes are racing into production while human code review quietly fades. Enterprises should treat AI-written code the way they treat junior developer code: no merge without review, no deploy without security checks, no exceptions. Until we enforce that discipline, AI code generation tools will keep doing what they are optimized for—shipping working features—while leaving code quality security risks, privacy, and accountability to chance.
