2026-07-23 · 2026-Q3
434 Exploitable Flaws Found Across 28 AI-Built Applications
Outside the model: Context Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Unknown
- Vendor response:
- Unknown
- In the wild:
- No
Target
28 applications built by five Anthropic and OpenAI models across three workflows: built from a written spec, thrown together from a casual prompt, and rewritten from an aging PHP codebase (Gnuboard7)
Impact
Xint researchers found 434 exploitable vulnerabilities in total, 196 in the newly built applications and 238 in the modernized Gnuboard7. Resource exhaustion and denial of service accounted for 93 of the 434, making missing rate limiting the single most common defect. As application complexity grew, the dominant class shifted toward authorization failures and insecure direct object references. Secrets exposure was among the most severe categories. SQL injection and cross-site scripting barely appeared, because the models reached for prepared statements and ORMs and sanitized inputs without being asked
Root Cause
Models handle the vulnerability classes that are well represented in training data and heavily linted for, and systematically omit the controls that have no local syntactic signal: rate limits, quotas, per-object authorization checks, and secret management. Those omissions scale with the size of the generated application