AI coding pitfall
Security failure pattern
Models can confidently produce authentication, cryptography, and input-handling code that looks professional and is subtly wrong. Security failure patterns are quiet until they are not.
How it shows up
- Broken authentication and authorisation patterns that pass a happy-path demo.
- Injection, SSRF, and insecure defaults introduced by "helpful" snippets.
- Secrets, PII, and internal details leaked through prompts, logs, or generated configs.
Who this pattern hits
- Security and engineering owners who distrust AI-produced authentication and cryptography paths.
- Product teams preparing for security review or incident-driven remediation.
- Teams that need a threat model, not only a patch list, after AI-assisted delivery.
When it matters: When authentication, secrets handling, and input validation look professional but fail a real threat model.
How we recover
Our solution
Threat-model and fix the real surface
We treat AI-introduced security debt as a recovery engagement: threat model the live system, fix auth and input paths that demos never exercise, and remove secrets and insecure defaults from the runtime path.
- Correct authentication and authorisation against real roles and edge cases.
- Close injection, SSRF, and default-insecure patterns in generated code paths.
- Rotate secrets, scrub leakage, and put secure defaults into the delivery pipeline.
We threat-model the real surface and fix the highest-risk paths first — with clear ownership of what remains accepted risk.
More →Talk through this pattern
Start on the home page with a short email to Robert, free and no obligation.
Book free recovery discussionWhat this failure mode is
Security failure in AI-built systems is when generated auth, secrets handling, or data flows look plausible but fail threat models, least privilege, or production incident scrutiny.
Symptoms you can observe
- Connection strings or API keys live in source, prompts, or client bundles.
- AuthZ checks are inconsistent across endpoints or trust client-supplied roles.
- Logs contain PII or secrets because generation defaults to verbose debugging.
- Dependencies and generated configs were never reviewed for supply-chain or exposure risk.
Why AI-accelerated delivery makes it worse
AI tools copy common insecure patterns confidently. Without threat modelling, those patterns ship as “done”.
How Mayordomo recovers it
- Threat-model the real attack surface with people who know the business risk.
- Move credentials to managed identity and vault patterns; kill secrets in source.
- Remediate high-risk findings with tests and monitoring so they do not return.
Related services: AI Project Recovery & Realignment · Azure cloud-native delivery. See also the failure patterns hub.