Is ChatGPT generated code secure?

ChatGPT-generated code frequently contains security vulnerabilities because the model learns from a broad corpus of code that includes insecure patterns and outdated practices. Research from Stanford University found that developers using AI code assistants produced significantly less secure code than those writing it manually. Common issues include hardcoded credentials, missing input validation, SQL injection vulnerabilities, and insecure use of cryptographic functions. UNPWNED checks externally observable exposure, configuration, dependency, endpoint, form, CORS, and error-disclosure signals. Internal validation and cryptographic logic require code review. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.