New Research and PoC Reveal Security Risks in LLM-Based Coding

A new study detailing the security risks of LLM-based coding warns that relying solely on large language models to generate application code can introduce critical vulnerabilities. According to a detailed blog post published on 22 August 2025, LLMs trained on broad internet data often reproduce unsafe patterns found in insecure example code, without warning developers.

The report highlights a live PoC showing how client-side code generated by an LLM can expose an email-sending API endpoint directly in browser JavaScript, with the script defining the API URL and submission logic on the front end. It also notes that a flaw seen in sample code for a pay-per-view plugin could be copied into production when used as demonstration code, and that remediation was deemed out of scope by the hosting provider since the vulnerable app was third-party.

The piece argues that human oversight remains essential for threat modelling, secure defaults, and integrating AI with rigorous code reviews and automated security testing to prevent LLM-generated vulnerabilities from reaching production.