Inherited Debt

Code generation tools are trained on decades of publicly available code — most of which embeds the same defect classes the Unforgivable Vulnerabilities paper describes.

AI does not generate safe code by default; it generates statistically average code. And average has been unsafe. AI-assisted development at scale means the Lucky 13 defect classes (see UV-01) ship faster than ever before, unless the training data, tooling, and accountability chain are redesigned with security as a non-negotiable requirement.

Discussion prompts

• What would you require of a code generation tool before trusting its output in your product?
• Which defect classes would you expect a code generation tool to refuse to produce?
• What would secure by design look like for the tool your team uses today?