risk
Insecure AI-generated code and hallucinated or typosquatted dependencies
Code-generating AI produces insecure defaults (injection-prone queries, weak authentication and session handling, unsafe logging) or specifies non-existent, hallucinated, or typosquatted packages that attackers pre-register, introducing vulnerabilities and malicious dependencies into production software.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- ai_governance
- domain
- AI Governance
- Secure Development (SDLC) & Application Security
- taxonomy
- owasp-llm-top10-2025
- inherent_rating
- high
Details
- risk_id
- ai-insecure-generated-code
- category
- ai_governance
- likelihood
- high
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- owasp-llm-top10-2025
Source
No record-specific source URL is provided.
Connections
- UC-AI-25 — Guide code-generating systems toward secure patterns and safe dependencies mitigates Insecure AI-generated code and hallucinated or typosquatted dependencies
- strength
- primary
- rationale
- Secure-by-default guidance and pinned, verified dependency specification for code-generating systems directly counter insecure generated code and hallucinated packages.
- UC-VULN-04 — Test software security during development and acceptance mitigates Insecure AI-generated code and hallucinated or typosquatted dependencies
- strength
- related
- rationale
- Static and dynamic testing before acceptance catches insecure patterns and unsafe dependencies in AI-generated code.