Why AI-Generated Code Is Vulnerable: Cause Taxonomy, Threat Mapping, and CI/CD Security Controls
Aljaberi, Ali Omar Naseeb
Aljaberi, Ali Omar Naseeb
Citations
Altmetric:
Author
Supervisor
Department
Computer Science
Embargo End Date
Type
Thesis
Date
2026
License
Language
English
Collections
Research Projects
Organizational Units
Journal Issue
Abstract
This thesis lies at the intersection of software development and cybersecurity, it investigates the security implications posed by AI-generated code, and more specifically, why they arise. It highlights this as a significant gap in existing research. Many studies measure the frequency of vulnerable AI-code, however, there is a lack of explanations regarding the origins of those vulnerabilities, their progression through development workflows, or their association with AI-specific threat models. Also, the research delves into the patterns of vulnerabilities in AI-generated code, their connections to AI-specific factors and CWE categories, their correspondence with MITRE ATLAS for AI-aware CI/CD security applications, and their socio-technical spread into production environments. To tackle this issue, this work introduces a pipeline approach that captures the entire lifecycle of AI-generated code from the formulation of prompts to structured security assessment. The analysis unit consists of prompt to completion to finding to annotated entry. A fixed, Python-only collection of security-relevant prompts was expanded into four propagation variations: base, reuse, refactor, and secure refactor, resulting in 536 prompt instances per provider and 2,144 generated samples across four provider sessions.
The outputs were evaluated using Bandit, Semgrep, and AI-aware risk detectors. They
were then normalized and enhanced with CWE labels, AI-cause classifications, propagation
vectors, MITRE ATLAS alignments, and human-factor indicators. This model contributes
to the open science principle by ensuring traceability and reproducibility. Outputs are
also machine-readable, which makes it appropriate for security tools used in downstream
applications and for CI/CD integrations.
The findings of this research indicate that AI-generated code is not fundamentally
insecure; instead, it indicates that under specific conditions, it can contain quantifiable and
systematic security risks. Among providers, finding rates varied from 0.194 to 0.267, with
results clustering around a consistent core of CWE categories rather than being randomly
distributed. The predominant AI-cause across runs was unsafe default, while hallucinated -
dependency emerged as a high-severity signal. Variations among providers were primarily
compositional: the OpenAI runs yielded the highest overall volume of findings, Claude
revealed additional AI-causes, CWE, and ATLAS categories, while K2-Think-v2 generated
the lowest overall yield but exhibited the most repetitive output profile. The thesis offers an
AI-cause taxonomy, an annotated vulnerability dataset, a cross-framework correspondence
between CWE and MITRE ATLAS, and a CI/CD-compatible threat library that converts
raw detection outcomes into reusable, actionable threat intelligence for secure AI-assisted
development.
Citation
Aljaberi, Ali Omar Naseeb, "Why AI-Generated Code Is Vulnerable: Cause Taxonomy, Threat Mapping, and CI/CD Security Controls," M.S. Thesis, Computer Science, MBZUAI, 2026.
Source
Conference
Keywords
LLM Security, AI-generated Code, Code Security, Threat Mapping